Timestamp checking: sometimes unnecessary or even annoying

[kjhermans]

Greetings,

I have a use case where I want to introduce brand new boxes into a closed network that uses openvpn. These boxes come with a pre-shared (unique) certificates, but do not have a clock that runs on time (they're brand new). And openvpn refuses to acknowledge its packets because they are unacceptably old. With static tunnel keys, I can understand this: you want to protect yourself from replay so you require that both nodes run more or less on the same schedule. But for dynamically negotiated tunnel keys it makes no sense, in my humble opinion: the key is new accross reboots, so you can rely only on counters for replay protection. Can I have an option where I can turn off replay detection using timestamps when not using static keys?

[janjust]

read the manual page and look for 'replay-window' ; most likely

Code: Select all

replay-window 64 0

will turn off timestamp checking