unknown opcode received

eric66300

Fri Nov 11 19:42:48 2011 TLS Error: unknown opcode received from 10.31.212.160:137 op=21
Fri Nov 11 19:42:48 2011 TLS Error: unknown opcode received from 10.31.212.160:137 op=21
Fri Nov 11 19:42:49 2011 TLS Error: unknown opcode received from 10.31.212.160:137 op=21
Fri Nov 11 19:42:49 2011 TLS Error: unknown opcode received from 10.31.212.160:137 op=21
Fri Nov 11 19:42:50 2011 TLS Error: unknown opcode received from 10.31.212.160:137 op=21
Fri Nov 11 19:42:50 2011 NOTE: --mute triggered...
Fri Nov 11 19:42:53 2011 5 variation(s) on previous 5 message(s) suppressed by --mute
Fri Nov 11 19:42:53 2011 SIGTERM received, sending exit notification to peer
Fri Nov 11 19:42:53 2011 TLS Error: unknown opcode received from 10.31.212.160:137 op=21
Fri Nov 11 19:42:54 2011 TLS Error: unknown opcode received from 10.31.212.160:137 op=21

here's my client config

client
dev tun
remote 1.2.3.4 1194
ca ca.crt
pull
proto udp
lport 53

persist-key

resolv-retry infinite

bind
verb 1
mute 5
comp-lzo
auth-user-pass password.txt

redirect-gateway def1
route-method exe
script-security 2 system
route-delay 2
reneg-sec 0
dhcp-option DNS 4.2.2.2
dhcp-option DNS 4.2.2.1
redirect-gateway def1
explicit-exit-notify
float

wanna know how to solve this issue?

thank you

janjust

there is invalid traffic coming in over the VPN link ; use

verb 5

for more details on both client and server side; post the client and server config files and logs.

eric66300

server config

dev tun
proto udp
local 1.2.3.4
port 1194

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
server 10.21.0.0 255.255.255.0
script-security 2
client-connect ./connect.sh
client-disconnect ./disconnect.sh
persist-key
persist-tun
client-cert-not-required
username-as-common-name
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.4.4"
comp-lzo
mssfix 1450
tun-mtu 1500
reneg-sec 0
tun-mtu-extra 32
status status/openvpn.log
log-append /var/log/openvpn/openvpn.log

and here is client log

Sat Nov 12 09:09:47 2011 us=471000 269 variation(s) on previous 5 message(s) suppressed by --mute
Sat Nov 12 09:09:47 2011 us=471000 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 12 2009
Sat Nov 12 09:09:47 2011 us=471000 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Nov 12 09:09:47 2011 us=471000 NOTE: --script-security method='system' is deprecated due to the fact that passed parameters will be subject to shell expansion
Sat Nov 12 09:09:48 2011 us=376000 ******* WARNING *******: null cipher specified, no encryption will be used
Sat Nov 12 09:09:48 2011 us=376000 LZO compression initialized
Sat Nov 12 09:09:48 2011 us=376000 Control Channel MTU parms [ L:1526 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Nov 12 09:09:48 2011 us=407000 Data Channel MTU parms [ L:1526 D:1400 EF:26 EB:135 ET:0 EL:0 AF:14/26 ]
Sat Nov 12 09:09:48 2011 us=407000 Local Options String: 'V4,dev-type tun,link-mtu 1526,tun-mtu 1500,proto UDPv4,comp-lzo,cipher [null-cipher],auth SHA1,keysize 0,key-method 2,tls-client'
Sat Nov 12 09:09:48 2011 us=407000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1526,tun-mtu 1500,proto UDPv4,comp-lzo,cipher [null-cipher],auth SHA1,keysize 0,key-method 2,tls-server'
Sat Nov 12 09:09:48 2011 us=407000 Local Options hash (VER=V4): 'ee6fec08'
Sat Nov 12 09:09:48 2011 us=407000 Expected Remote Options hash (VER=V4): 'c4954d56'
Sat Nov 12 09:09:48 2011 us=407000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Nov 12 09:09:48 2011 us=407000 UDPv4 link local (bound): [undef]:53
Sat Nov 12 09:09:48 2011 us=407000 UDPv4 link remote: 1.2.3.4:1194
Sat Nov 12 09:09:48 2011 us=797000 TLS: Initial packet from 1.2.3.4:1194, sid=a1da532a 8640fa62
Sat Nov 12 09:09:48 2011 us=797000 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Nov 12 09:09:51 2011 us=433000 VERIFY OK: depth=1, /C=ph/ST=ncr/L=qc/O=TTP/OU=roar/CN=tigervpn/name=tcp/emailAddress=ourserver@gmail.com
Sat Nov 12 09:09:51 2011 us=449000 VERIFY OK: nsCertType=SERVER
Sat Nov 12 09:09:51 2011 us=449000 VERIFY OK: depth=0, /C=ph/ST=ncr/L=qc/O=TTP/OU=roar/CN=server/name=tcp/emailAddress=ourserver@gmail.com
Sat Nov 12 09:09:54 2011 us=23000 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1526', remote='link-mtu 1558'
Sat Nov 12 09:09:54 2011 us=23000 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
Sat Nov 12 09:09:54 2011 us=23000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 12 09:09:54 2011 us=23000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 12 09:09:54 2011 us=23000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Nov 12 09:09:54 2011 us=23000 [server] Peer Connection Initiated with 63.223.107.109:1194
Sat Nov 12 09:09:56 2011 us=160000 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Nov 12 09:09:56 2011 us=613000 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5'
Sat Nov 12 09:09:56 2011 us=613000 OPTIONS IMPORT: --ifconfig/up options modified
Sat Nov 12 09:09:56 2011 us=613000 OPTIONS IMPORT: route options modified
Sat Nov 12 09:09:56 2011 us=613000 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Nov 12 09:09:56 2011 us=659000 ROUTE default_gateway=10.31.23.172
Sat Nov 12 09:09:56 2011 us=769000 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{C5FB24F8-458F-4E71-871C-40B868325642}.tap
Sat Nov 12 09:09:56 2011 us=769000 TAP-Win32 Driver Version 9.8
Sat Nov 12 09:09:56 2011 us=769000 TAP-Win32 MTU=1500
Sat Nov 12 09:09:56 2011 us=784000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {C5FB24F8-458F-4E71-871C-40B868325642} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sat Nov 12 09:09:56 2011 us=784000 DHCP option string: 06100402 02020402 0201d043 dede0808 0404
Sat Nov 12 09:09:56 2011 us=784000 Successful ARP Flush on interface [18] {C5FB24F8-458F-4E71-871C-40B868325642}
Sat Nov 12 09:09:57 2011 us=549000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:09:57 2011 us=564000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:09:57 2011 us=673000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:09:57 2011 us=673000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:09:58 2011 us=219000 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sat Nov 12 09:09:58 2011 us=219000 C:\WINDOWS\system32\route.exe ADD 1.2.3.4 MASK 255.255.255.255 10.31.23.172
OK!
Sat Nov 12 09:10:02 2011 us=104000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
OK!
Sat Nov 12 09:10:02 2011 us=541000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
OK!
Sat Nov 12 09:10:06 2011 us=441000 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
OK!
Sat Nov 12 09:10:08 2011 us=609000 Initialization Sequence Completed
Sat Nov 12 09:10:08 2011 us=609000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:10:08 2011 us=609000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:10:08 2011 us=609000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:10:08 2011 us=609000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:10:08 2011 us=609000 TLS Error: unknown opcode received from 10.8.0.6:137 op=28
Sat Nov 12 09:10:08 2011 us=609000 NOTE: --mute triggered...

janjust

the warning messages

Sat Nov 12 09:09:54 2011 us=23000 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1526', remote='link-mtu 1558'
Sat Nov 12 09:09:54 2011 us=23000 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'

need to be fixed first ; try adding

comp-lzo
mssfix 1450
tun-mtu 1500
tun-mtu-extra 32

to the client config and reconnect.

eric66300

wow it worked, what if we use fragment can it be possible to burst our net connection?

thank you

janjust

you can play with 'fragment' and 'mssfix' to optimize your network throughput ; it all depends on the network connection between client and server to determine what is best.

For a regular LAN connection the defaults are good.

eric66300

thank you