Disabling auth with "auth none" disables HMAC firewall too?

sftf

Is it two different independent HMACs or not?

janjust

auth none

disables the signing of data channel packets; the HMAC firewall for the control channel is configured using

tls-auth <file>

and is not affected by this.

sftf

janjust wrote
auth none
disables the signing of data channel packets; the HMAC firewall for the control channel is configured using
tls-auth <file>
and is not affected by this.

If I correctly understood your answer openvpn should block clients with the wrong key even with "auth none" on both client and server.
But I have noticed that with "auth none" the client with wrong key still can connect to the server, i.e. HMAC firewall disabled.
But when I comment "auth none" (i.e. enable default auth) on client and server, client can't establish vpn tunnel with messages in server log:

Authenticate/Decrypt packet error: packet HMAC authentication failed
TLS Error: incoming packet authentication failed from [AF_INET]192.168.55.55:1094

So, as for me, HMAC firewall work with "auth" option enabled only.
Where I'm wrong?