Hi everyone,
I just recently installed a new vpn server using openvpn 2.4.7-1 on a debian 10.2 machine.
My problem is that I have server configured to use
--verb 3
and
--mute-replay-warnings
as you can see in the attached Server Config but I'm still seeing a lot of these errors/warnings on my logs:
tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1578390112) Tue Jan 7 09:41:52 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings: 6 Time(s)
I also see these ones:
TLS Error: tls-crypt unwrapping failed from [AF_INET]1.1.1.1:57158: 1 Time(s)
This is my server config.
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.0.0.1"
push "dhcp-option DNS 1.1.1.1"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_tWgA95SGQp4zAbWN.crt
key server_tWgA95SGQp4zAbWN.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
mute-replay-warnings
and this is my client config:
client
proto udp
remote x.x.x.x 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_tWgA95SGQp4zAbWN name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
-----END ENCRYPTED PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-crypt>
Can someone help me out with that ? I'm not sure if the mute-reply-warnings isn't working or it's just appearing because of some misconfiguration.
Thanks in advance.
