I'm getting an error on a server log:
Authenticate/Decrypt packet error: packet HMAC authentication failed
TLS Error: incoming packet authentication failed from [AF_INET]
proto udp
port 9000
dev tun
mode server
ca /etc/openvpn/cert/ca.crt
cert /etc/openvpn/cert/clinic_atom.crt
key /etc/openvpn/cert/clinic_atom.key
dh /etc/openvpn/cert/dh.pem
topology subnet
server 192.168.141.0 255.255.255.0
client-to-client
ifconfig-pool-persist ipp.txt
client-config-dir ccd
keepalive 10 120
tls-auth vpn_clinic.key 0
tun-mtu 1500
tun-mtu-extra 32
mssfix 1200
duplicate-cn
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 3
clinic_atom.conf
client
dev tun
proto udp
port 9070
topology subnet
remote xxx.xx.xx.xx 9070 # static IP
resolv-retry infinite
tun-mtu 1500
tun-mtu-extra 32
mssfix 1200
persist-key
persist-tun
remote-cert-tls server
ca "/etc/openvpn/clinic_atom/ca.crt"
cert "/etc/openvpn/clinic_atom/syscon7.crt"
key "/etc/openvpn/clinic_atom/syscon7.key"
tls-auth "/etc/openvpn/clinic_atom/ta.key" 1
comp-lzo
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 3
I've install the files using my notes:
On SERVER do:
cd /usr/share/easy-rsa/
export EASYRSA_REQ_COUNTRY="US"
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa build-server-full server_clinic_8amd nopass
./easyrsa gen-dh
openvpn --genkey --secret ta.key
mkdir /etc/openvpn/cert
cp pki/ca.crt /etc/openvpn/cert/
cp pki/issued/server_clinic_8amd.crt /etc/openvpn/cert/
cp pki/private/server_clinic_8amd.key /etc/openvpn/cert/
cp pki/dh.pem /etc/openvpn/cert/
cp ta.key /etc/openvpn/cert/
source ./vars (if computer was re-booted and above sequece wasn't run)
./easyrsa build-client-full syscon7 nopass (this is client key pair)
======= note ===========
the above file creates two client keys that store "syscon7" name, they are coppied to client computer and simple file resides on the server:
ccd/syscon7
with IP assignment:
ifconfig-push 192.168.141.7 255.255.255.0
======== end note =========
cd /etc/init.d/
ln -s openvpn openvpn.server_clinic_8amd
openvpn.server_clinic_8amd start
Copy the following files to Client (via USB or ssh 'zip_it" etc. pay attention to permission)
=> The public ca.crt certificate is needed on all servers and clients.
=> The private ca.key key is secret and only needed on the key generating machine (not in cert/ folder).
=> A server needs server.crt, and dh2048.pem (public), and server.key and ta.key (private).
=> A client needs client.crt (public), and client.key and ta.key (private).
eg.
cp pki/ca.crt /home/fd/keys/ (client keys)
cp pki/issued/syscon7.crt /home/fd/keys/
cp pki/private/syscon7.key /home/fd/keys/
cp ta.key /home/fd/keys/
Copy file from instruction above to server /etc/openvpn
I copied them to dir "cert" on /etc/openvpn/
(on server)
ll /etc/openvpn/cert/
total 28
-rw------- 1 root root 1749 Feb 7 12:24 ca.crt
-rw------- 1 root root 424 Feb 7 12:28 dh.pem
-rw------- 1 root root 5280 Feb 7 12:26 server_clinic_8amd.crt
-rw------- 1 root root 1704 Feb 7 12:27 server_clinic_8amd.key
-rw------- 1 root root 636 Feb 7 13:35 ta.key
(on server PC)
[code]cat server_clinic_8amd.conf
