tls-crypt unwrap error: bad packet ID

pierre.huybens@yahoo.fr

Good morning,

I have the same issue without the line # 11 (tls-crypt) in the client config file.
openvpn is installed on raspberry pi (

$ openvpn --version
OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 14 2018

I have copy the client file on my iphone. When I try to connect from my LAN, I am able to open the VPN. When trying with the same configuration file and the same iphone outside the LAN , I have the following error :

Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 UDPv4 READ [54] from [AF_INET]109.130.167.3:58175: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 sid=0f800c68 7da3e365 [ ] pid=351 DATA 10724333 c29a1363 a9581874 a1d02c54 4b0d2178 bfee2d9e ceeda28e 70d7342[more...]
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TLS: control channel, op=P_CONTROL_HARD_RESET_CLIENT_V2, IP=[AF_INET]109.130.167.3:58175
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TLS: initial packet test, i=0 state=S_PRE_START, mysid=8caaf919 0637378f, rec-sid=0f800c68 7da3e365, rec-ip=[AF_INET]109.130.167.3:58175, stored-sid=0f800c68 7da3e365, stored-ip=[AF_INET]109.130.167.3:58175
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TLS: found match, session[0], sid=0f800c68 7da3e365
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TLS-CRYPT UNWRAP FROM: 380f800c 687da3e3 65000000 015f1072 4333c29a 1363a958 1874a1d0 2c544b0[more...]
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TLS-CRYPT UNWRAP AD: 380f800c 687da3e3 65000000 015f1072 43
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TLS-CRYPT UNWRAP TO: 00000000 00
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 PID_TEST [0] [TLS_WRAP-0] [1] 1594913347:1 1594913347:1 t=1594913348[0] r=[-1,64,15,0,1] sl=[63,1,64,272]
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 PID_ERR replay [0] [TLS_WRAP-0] [1] 1594913347:1 1594913347:1 t=1594913348[0] r=[-1,64,15,0,1] sl=[63,1,64,272]
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1594913347) Thu Jul 16 17:29:07 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 tls-crypt unwrap error: packet replay
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TLS Error: tls-crypt unwrapping failed from [AF_INET]109.130.167.3:58175
Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 TIMER: coarse timer wakeup 1 seconds

TinCanTech

pierre.huybens@yahoo.fr wrote Jul 16 17:29:08 mapi3 ovpn-server[23278]: 109.130.167.3:58175 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1594913347) Thu Jul 16 17:29:07 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

It's generally caused by congested networks or things like that.

Your VPN should still function properly.

pierre.huybens@yahoo.fr

Well , I try opening the vpn from my local network and this succeed all the time. When trying at the same time from my neighbor network it is failing.
Each time locally it is working and from remote network it is failing with the same reason. So I do not think this could be related to a congested networks.
The client file refer to a remote host so I do not connect directly to the OPEN VPN server but also from the internet network
client
dev tun
proto udp
remote <myhost>.ddns.net 1194
remote-cert-tls server
tls-version-min 1.2
...

TinCanTech

pierre.huybens@yahoo.fr wrote I do not think this could be related to a congested networks

and things like that .. the network you are using has been misconfigured -- Most likely a router.

pierre.huybens@yahoo.fr

what could be misconfigured ? locally this is working fine and remotely the same client is able to connect to the server because the server got an error? what is the meaning of the error ? I set the trace to level 9 but this does not help for me ? Did you have other information with the trace provided ?

TinCanTech

pierre.huybens@yahoo.fr wrote what is the meaning of the error ?

TinCanTech wrote tls-crypt unwrap error: bad packet ID (may be a replay):

If you can't fix it then you will have to ignore it.

pierre.huybens@yahoo.fr

I can't fix it , this does not help to understand why I cannot open my VPN from outside the local network ? and I can reach the server because each time I try , I have this error "tls-crypt unwrap error" ? currently we did not progress from my first question

TinCanTech

Does your VPN work from the remote location ?

IE: Can your client ping your server on the VPN IP (eg. 10.8.0.1) and vice-versa .. ?

pierre.huybens@yahoo.fr

To be able to ping the server at the address 10.8.0.1, the VPN should be established, the tunnel between the client and the server should succeed. Currently this is failing.
The client can access the server from the public DDNS name of the server, this is the first step to establish the tunnel and this one works.

TinCanTech

Please post full details as outlined here:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963