4 Repeating errors in server log, no actual affect on connection

EagleX

Hello all,

I'm running a simple OVPN 2.4.8 server on Windows, which sits on a computer behind a standard firewall and then straight to the internet. Nothing complicated. It has 3 clients connecting to it daily. Overall, everything works great and I don't have any problems, other than repeating errors that shows up in the server's log. I have googled all of them and looked in the forums, the wiki, the manual, etc, but I couldn't find/couldn't understand what can be the actual case and solution.

The errors are:

1. "read UDPv4: Unknown error (code=10054)" - Shows up a lot. As far as I understood from my own research, it's usually related to firewall/ports/wrong connectivity settings, yet everything is properly configured (Port forwarded, exception added in firewall, etc.), but it keep showing up.

The following appear once every few hours, even less sometimes, and happen with all clients (Not at the same time, it's random)

2. "AEAD Decrypt error: bad packet ID (may be a replay)" - Don't know if related, but used to appear much more frequently before changing fragment and mssfix flags.

3. FRAG: outgoing buffer is not empty, len=[1404,700] - Frag telling me it's something to do with fragment, but I couldn't find much info online and couldn't fix it myself.

4. TLS: tls_process: killed expiring key - Only shows every once in a while, when renegotiating (Set to the default 3600 secs)

dev-node "bla"
server 10.8.0.0 255.255.255.0
port *****

proto udp4
dev tun

tun-mtu 1500
fragment 1460
mssfix

tls-server
tls-auth "ta.key" 0

ca
cert
key
dh

keepalive 10 60
cipher AES-256-CBC
auth SHA256

push "route ip sub"

persist-key
persist-tun

verb 4

remote ip here
client
port *****

proto udp4
dev tun

tun-mtu 1500
fragment 1460
mssfix

tls-client
tls-auth "ta.key" 1
remote-cert-tls server

ca "ca.crt"
pkcs12 ".p12"

cipher AES-256-CBC
auth SHA256

persist-key
persist-tun

verb 3
mute 20

I highly appreciate your help and I thank you in advance! 🙂

Noam.

TinCanTech

EagleX wrote The errors are:

1. "read UDPv4: Unknown error (code=10054)" - Shows up a lot. As far as I understood from my own research, it's usually related to firewall/ports/wrong connectivity settings, yet everything is properly configured (Port forwarded, exception added in firewall, etc.), but it keep showing up.

It means ICMP returned "Port unreachable" or something like that.

EagleX wrote The following appear once every few hours, even less sometimes, and happen with all clients (Not at the same time, it's random)

2. "AEAD Decrypt error: bad packet ID (may be a replay)" - Don't know if related, but used to appear much more frequently before changing fragment and mssfix flags.

Replays are due to UDP, read the full error message and see the details it recommends.

EagleX wrote 3. FRAG: outgoing buffer is not empty, len=[1404,700] - Frag telling me it's something to do with fragment, but I couldn't find much info online and couldn't fix it myself.

You have made --fragment worse .. you don't need it. Nor --mssfix

EagleX wrote 4. TLS: tls_process: killed expiring key - Only shows every once in a while, when renegotiating (Set to the default 3600 secs)

That is normal and you are correct.