Hi there, I'm trying to connect to an OpenVPN server which is basically my router. I receive this error: 2021-04-30 14:39:25 OPTIONS IMPORT: timers and/or timeouts modified 2021-04-30 14:39:25 OPTIONS IMPORT: --ifconfig/up options modified 2021-04-30 14:39:25 OPTIONS IMPORT: route options modified 2021-04-30 14:39:25 OPTIONS ERROR: failed to negotiate cipher with server. Configure --data-ciphers-fallback if you want to connect to this server. 2021-04-30 14:39:25 ERROR: Failed to apply push options 2021-04-30 14:39:25 Failed to open tun/tap interface 2021-04-30 14:39:25 SIGUSR1[soft,process-push-msg-failed] received, process restarting 2021-04-30 14:39:25 MANAGEMENT: >STATE:1619786365,RECONNECTING,process-push-msg-failed,,,,, 2021-04-30 14:39:25 Restart pause, 5 second(s) I just searched for the error and found some users saying just add "ncp-disable" in my OpenVPN config on the client. But then I get this error message which I don't understand: 2021-04-30 14:51:49 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set. 2021-04-30 14:51:49 DEPRECATED OPTION: ncp-disable. Disabling cipher negotiation is a deprecated debug feature that will be removed in OpenVPN 2.6 Options error: --ncp-disable needs an explicit --cipher or --data-ciphers-fallback config option Use --help for more information. Please could you help me? If I have to add something to my config (like ncp disable...) will this affect the security level? Here is my current config: client dev tun proto udp remote ***HOSTNAME*** 1194 resolv-retry infinite nobind persist-key persist-tun pkcs12 NAS.p12 comp-lzo verb 3 remote-cert-tls server ncp-disable Thanks a lot :)

See if you can find a suitable combination here: https://community.openvpn.net/openvpn/wiki/CipherNegotiation

Thanks for your quick reply!! I found this site too but I still don't get it ;) Do I have to know the OpenVPN version which uses my router? What should I try to add to the config, something like data-ciphers ... ? kind regards

Ok... I just found out that my router Easybox uses OpenVPN 2.3.6 as server. So I would need to add „—cipher“ to my config? Thanks

I believe you need --[b]cipher[/b] in your server: [code]cipher AES-256-GCM[/code] The client should pick that automatically.

Sadly I cant modify such parameters on the server. Any chance to solve the issue on client side (maybe in the .ovpn file)? Should I try an older OpenVPN client

What cipher does your server use ?

Sorry, but I dont know. All I know is that the connection over iOS app works fine and the installed version on the server.

Try reading the log on your iOS device and also look for the log on your server. You may need to consult your router manual ..

The log on iOS has the information. Thanks for the hint ! cipher: BF-CBC digest: SHA1 compress: LZO_STUB peer ID: -1 I removed now the "ncp disable" line from my config and added "cipher BF-CBC". Aaaaaaaand it works!! The log just shows some WARNINGS about security. I think the one is about COMPRESSION and the other about SWEET32 attacks. Any chance to avoid those insecurities? LOG Warnings; Sat May 01 20:30:51 2021 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set. Sat May 01 20:30:51 2021 DEPRECATED OPTION: --cipher set to 'BF-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'BF-CBC' to --data-ciphers or change --cipher 'BF-CBC' to --data-ciphers-fallback 'BF-CBC' to silence this warning. Sat May 01 20:31:00 2021 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Sat May 01 20:31:00 2021 WARNING: INSECURE cipher (BF-CBC) with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC). Support for these insecure ciphers will be removed in OpenVPN 2.6. Sat May 01 20:31:04 2021 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.

[quote=commy post_id=99048 time=1619893673 user_id=53512] The log just shows some WARNINGS about security. I think the one is about COMPRESSION and the other about SWEET32 attacks. Any chance to avoid those insecurities? [/quote]Sure, configure your server to use a secure cipher and to not use compression.

Can't connect with Windows to OVPN server

TinCanTech

ninaaa wrote I just want to know whether my Vpn server is running

My Magic-Eight-Ball says: Don't count on it.

ninaaa

thanks for the factual answers, your magic ball is probably just a ball

TinCanTech

Thanks for hijacking somebody-elses thread with your expectant nonsense.

I bet my Magic-Eight-Ball knows more about your computer than you do.

If you want real help then read this:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603

And, for the record, You get what you pay for, which, in your case, ain't gonna be much.

ninaaa

thanks, I have a problem that I cannot fix myself. My vpnserver is 800km away from another country and I no longer answer it. If someone can help me, I would pay to save myself the 800km. meanwhile I think that the license could have expired ?!

TinCanTech

Can you at least say which version of OpenVPN your server is ?

ninaaa

It's a raspberry pi with ubuntu where the OpenVpn is running everything is behind the modem. Everything has worked for over a year. I don't know which version, the certificate may have expired. Open VPN is still running because if I use the wrong password it will recognized as wrong!

ninaaa

Is there a possibility via the internet (ssh is activated, username and password is available) to the operating system running on the Raspberry (behind the modem, port forwarding is only set up for OpenVpn)? My knowledge is limited in this direction!

TinCanTech

ninaaa wrote If someone can help me, I would pay to save myself the 800km

You can contact me: tincantech <at> protonmail dot com -- Fees will apply.

MrCopperfield

Hi,

I have the same error:
Sun May 02 11:35:23 2021 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun May 02 11:35:23 2021 TLS Error: TLS handshake failed

Did you guess how to solve it?

Thanks.

« Previous Page