DDoS prevention. tls-auth vs tls-crypt

nikkoaki

Greetings, i already asked about this a week ago on reddit but no one could really give me an answer. I'm going to copy-paste my question and ask a second one as well.

I'm not trying to figure out all the differences between tls-auth and tsl-crypt, just how they can help prevent DDoS attacks.

This guy here: https://serverfault.com/questions/929484/openvpn-2-4-security-differences-between-tls-crypt-and-tls-auth
And this guy here: https://security.stackexchange.com/questions/151194/openvpns-new-tls-crypt-option
state that one difference between the two is that tls-crypt can help prevent DDoS attacks by dropping requests that don't present the specified key.
However, in the official documentation here and here, it's written that tls-auth already does that.

" The primary benefit is that an unauthenticated client cannot cause the same CPU/crypto load against a server as the junk traffic can be dropped much sooner. This can aid in mitigating denial-of-service attempts. "

" The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. It can protect against:

+ DoS attacks or port flooding on the OpenVPN UDP port."

So what gives? Is tls-crypt better or not at this?

Another question i have is about port scanning. That same official documentation also states that tls-auth can also prevent port scanning

+ Port scanning to determine which server UDP ports are in a listening state.

But one thing i've noticed with both tls-auth and tls-crypt is that, let's say for example that there is a server running in port 1194 with tls-auth. Let's also say that i'm a guy trying to see if that machine is running openvpn. I can open for example an android client app, if i try to connect let's say to port 2000, i will get the log spammed with messages saying "connection refused", however, if i try to connect to port 1194, even with incorrect credentials, the client will just stay there trying and trying. I can clearly determine that openvpn is running behind that port.

Am i missing something?

TinCanTech

nikkoaki wrote But one thing i've noticed with both tls-auth and tls-crypt is that, let's say for example that there is a server running in port 1194 with tls-auth. Let's also say that i'm a guy trying to see if that machine is running openvpn. I can open for example an android client app, if i try to connect let's say to port 2000, i will get the log spammed with messages saying "connection refused", however, if i try to connect to port 1194, even with incorrect credentials, the client will just stay there trying and trying. I can clearly determine that openvpn is running behind that port.

Short answer: No you can not, you are misunderstanding your client log.

--tls-auth vs --tls-crypt

The essential difference is that --tls-crypt provides the same HMAC function as --tls-auth and also encrypts the TLS header.

nikkoaki

TinCanTech wrote Short answer: No you can not, you are misunderstanding your client log.

Thank you for your reply. I still don't understand what you mean by that.
Trying to connect to port 1904 won't show anything in the client log, trying to connect to any other port will show "Connection refused". Can't this information be used to tell that there is an openvpn server listening on port 1904?
I'm not trying to be smarter than you or anyone in here. I genuinely don't know what i'm talking about, that's why i'm asking for clarification.

TinCanTech

You can only detect a properly configured server if you have the correct credentials to connect.

You cannot randomly scan for openvpn servers if they are suitably protected.

nikkoaki

Sure, i may not know if the server is properly configured. I'm not saying this because i want to try to log in to that server. Of course that is never going to happen if i don't have the credentials.
I'm basing my question on what it's written on the official documentation:

"It can protect against:

DoS attacks or port flooding on the OpenVPN UDP port.
Port scanning to determine which server UDP ports are in a listening state."

I'm sorry, english isn't my main language, i can't really express myself the way i wanted.
Doesn't the fact that the client is getting no "Connection refused" message means that IT CAN be determined that there is a server listening in that port?

Pippin

They both do the same but tls-crypt also encrypts the control channel.

Trying to connect to port 1904 won't show anything in the client log, trying to connect to any other port will show "Connection refused".

Have a firewall running there?
If it is rejecting then yeah, you get connection refused on any other port (possibly so when not firewalled too).
OpenVPNs tls-xxx will silently drop the traffic on the open port.

You can test by undoing the port forward and try to connect.

nikkoaki

Pippin wrote Have a firewall running there?
If it is rejecting then yeah, you get connection refused on any other port (possibly so when not firewalled too).
OpenVPNs tls-xxx will silently drop the traffic on the open port.
You can test by undoing the port forward and try to connect.

No firewall, just behind a NAT.
If i do a portscan on grc.com on any closed port i get "stealth" as the result. That means "no unsolicited packets were received/NO Ping reply (ICMP Echo) was received". I get the same result on my openvpn port, which is expected.
The difference comes only on an openvpn client. Trying to connect to a random port doesn't give the same result as trying to connect to the port the server is using, the fact that there is a difference makes me have the opinion that one can find out if openvpn is listening on a specific port just by trying to connect to it and seeing if the connection is refused or not.. i know it's not that simple, but can't you understand what i mean?
I really wanted to hear a good explanation into why this isn't the case at all.

Pippin

No firewall, just behind a NAT.

That's kind of a contradiction, is it not? 😉

the fact that there is a difference makes me have the opinion that one can find out if openvpn is listening on a specific port just by trying to connect to it

Really, just close down what you do not need, keep software updated and be done with it.

Pippin signing of 😉

TinCanTech

nikkoaki wrote the fact that there is a difference makes me have the opinion that one can find out if openvpn is listening on a specific port just by trying to connect to it and seeing if the connection is refused or not

You can only do this because it is your server and you have the correct credentials. This will not work on my servers, for example.

nikkoaki

TinCanTech wrote
nikkoaki wrote the fact that there is a difference makes me have the opinion that one can find out if openvpn is listening on a specific port just by trying to connect to it and seeing if the connection is refused or not
You can only do this because it is your server and you have the correct credentials. This will not work on my servers, for example.

I was using wrong credentials on purpose. If i had the right credentials, it would connect to it.
I'm not making these questions because i'm scared that my server might get hacked, etc.. but yeah i should drop it. Thank you for your time anyway.

@Pippin
That's kind of a contradiction, is it not? 😉

No it is not, but let's not get into that because it's another story.

Pippin

You can report this client log behavior on the users mailing list if you wish.
Register first:
https://sourceforge.net/projects/openvpn/lists/openvpn-users

https://sourceforge.net/p/openvpn/mailman/openvpn-users