ASUS router cipher error for OpenVPN Connect

[WonderWoman]

Hello,

Really frustrated here............Need big help.

I am trying to build my home network and have the following:

Asus RT-AX3000 V2 WiFi Router
Have OpenVPN client for Asus (have it turned on in router)
2 laptops
2 Connections available for internet (my ISP = Optimum/Altice and also my T-Mobile 5G iPhone Hotspot)
QNAP NAS TS932PX (server)

I was using the generic OpenVPN client right off the OpenVPN website and was able to get the VPN to connect and I could tell it would connect both on the client and on the router because the profile would light up. Since removing the generic OpenVPN client and replacing it with the Asus specific client I am no longer able to get it to connect. I get a cipher error (providing log file contents). I orginally had the cipher set to 128 but it referenced something about being set to 256 and I needed to add the data cipher so I switched it to the 256 cipher but it still will not connect and still gives a 256 cipher error.

I need to be able to connect to my NAS remotely befause I am not living 100% of the time at my own apartment as I am continuing to recuperate at my brother's apartment after having major spine surgery. When I was able to get the OpenVPN client to connect I was not able to map anything on my NAS/couldn't access my NAS at all. So apparently I was connecting only to the VPN server on my router.

I have appropriate port forwarding and IP address set up on the router.
I have been posting my work on Reddit on 2 forums, one is the home networking and the other is for Ausus but not getting much help. This should NOT be this hard to do.

I have the native VPN server on the NAS turned off because you cannot have two VPN servers simultaneously. I have the firewall on the router enabled and have set up an IPv4 Inbound firewall rule utilizing the IP for the VPN and the TCP port for the VPN (1194)

Question about the above - do I need to set up an additional rule utilizing the NAS IP and TCP port (8080)?

Here's the contents of the log file from the Asus OpenVPN client:

2023-05-06 19:16:52 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
2023-05-06 19:16:52 OpenVPN 2.6.3 [git:v2.6.3/94aad8c51043a805] Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Apr 26 2023
2023-05-06 19:16:52 Windows version 10.0 (Windows 10 or greater), amd64 executable
2023-05-06 19:16:52 library versions: OpenSSL 3.1.0 14 Mar 2023, LZO 2.10
2023-05-06 19:16:52 DCO version: v0
2023-05-06 19:16:55 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-06 19:16:55 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-06 19:16:55 TCP_CLIENT link local: (not bound)
2023-05-06 19:16:55 TCP_CLIENT link remote: [AF_INET]74.88.40.168:1194
2023-05-06 19:16:56 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-05-06 19:16:56 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-06 19:16:58 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-06 19:16:58 ERROR: Failed to apply push options
2023-05-06 19:16:58 Failed to open tun/tap interface
2023-05-06 19:16:58 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-06 19:16:59 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-06 19:16:59 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-06 19:16:59 TCP_CLIENT link local: (not bound)
2023-05-06 19:16:59 TCP_CLIENT link remote: [AF_INET]74.88.40.168:1194
2023-05-06 19:16:59 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-06 19:17:00 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-06 19:17:00 ERROR: Failed to apply push options
2023-05-06 19:17:00 Failed to open tun/tap interface
2023-05-06 19:17:00 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-06 19:17:01 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:01 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-06 19:17:01 TCP_CLIENT link local: (not bound)
2023-05-06 19:17:01 TCP_CLIENT link remote: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:02 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-06 19:17:03 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-06 19:17:03 ERROR: Failed to apply push options
2023-05-06 19:17:03 Failed to open tun/tap interface
2023-05-06 19:17:03 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-06 19:17:04 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:04 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-06 19:17:04 TCP_CLIENT link local: (not bound)
2023-05-06 19:17:04 TCP_CLIENT link remote: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:05 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-06 19:17:07 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-06 19:17:07 ERROR: Failed to apply push options
2023-05-06 19:17:07 Failed to open tun/tap interface
2023-05-06 19:17:07 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-06 19:17:08 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:08 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-06 19:17:08 TCP_CLIENT link local: (not bound)
2023-05-06 19:17:08 TCP_CLIENT link remote: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:09 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-06 19:17:10 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-06 19:17:10 ERROR: Failed to apply push options
2023-05-06 19:17:10 Failed to open tun/tap interface
2023-05-06 19:17:10 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-06 19:17:12 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:12 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-06 19:17:12 TCP_CLIENT link local: (not bound)
2023-05-06 19:17:12 TCP_CLIENT link remote: [AF_INET]74.88.40.168:1194
2023-05-06 19:17:13 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-06 19:17:15 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-06 19:17:15 ERROR: Failed to apply push options
2023-05-06 19:17:15 Failed to open tun/tap interface
2023-05-06 19:17:15 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-06 19:17:16 SIGTERM[hard,init_instance] received, process exiting

[WonderWoman]

I have decided to do a factory reset to the router to start fresh today. I have been all over the router trying to make things work and cannot track everything. I built a new network, turned on OpenVPN and left everything set to default. I exported a new config file and iported it into the Asus specific OpenVPN client but still cannot connect because of a "data cipher error". It keeps telling me I have to add something to the data ciphers or that I have something misconfigured and I don't see any fields referring to data ciphers on the router or in the client. Here's the specific error in the log file:

ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.

Here's the ENTIRE log file from the first connection attempt.

2023-05-07 13:52:50 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2023-05-07 13:52:50 DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
2023-05-07 13:52:50 OpenVPN 2.6.3 [git:v2.6.3/94aad8c51043a805] Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Apr 26 2023
2023-05-07 13:52:50 Windows version 10.0 (Windows 10 or greater), amd64 executable
2023-05-07 13:52:50 library versions: OpenSSL 3.1.0 14 Mar 2023, LZO 2.10
2023-05-07 13:52:50 DCO version: v0
2023-05-07 13:53:02 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:02 UDPv4 link local: (not bound)
2023-05-07 13:53:02 UDPv4 link remote: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:02 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-05-07 13:53:03 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 13:53:04 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 13:53:04 ERROR: Failed to apply push options
2023-05-07 13:53:04 Failed to open tun/tap interface
2023-05-07 13:53:04 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 13:53:05 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:05 UDPv4 link local: (not bound)
2023-05-07 13:53:05 UDPv4 link remote: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:08 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 13:53:09 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 13:53:09 ERROR: Failed to apply push options
2023-05-07 13:53:09 Failed to open tun/tap interface
2023-05-07 13:53:09 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 13:53:10 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:10 UDPv4 link local: (not bound)
2023-05-07 13:53:10 UDPv4 link remote: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:10 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 13:53:12 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 13:53:12 ERROR: Failed to apply push options
2023-05-07 13:53:12 Failed to open tun/tap interface
2023-05-07 13:53:12 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 13:53:13 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:13 UDPv4 link local: (not bound)
2023-05-07 13:53:13 UDPv4 link remote: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:14 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 13:53:16 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 13:53:16 ERROR: Failed to apply push options
2023-05-07 13:53:16 Failed to open tun/tap interface
2023-05-07 13:53:16 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 13:53:17 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:17 UDPv4 link local: (not bound)
2023-05-07 13:53:17 UDPv4 link remote: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:17 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 13:53:18 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 13:53:18 ERROR: Failed to apply push options
2023-05-07 13:53:18 Failed to open tun/tap interface
2023-05-07 13:53:18 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 13:53:20 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:20 UDPv4 link local: (not bound)
2023-05-07 13:53:20 UDPv4 link remote: [AF_INET]74.88.40.168:1194
2023-05-07 13:53:20 SIGTERM[hard,] received, process exiting

[WonderWoman]

Just checked the settings on the router again for OpenVPN - changed to the 256 versus the default 128 and attempted to connect again. Still cannot connect. Here's the log file:

2023-05-07 14:09:36 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
2023-05-07 14:09:36 OpenVPN 2.6.3 [git:v2.6.3/94aad8c51043a805] Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Apr 26 2023
2023-05-07 14:09:36 Windows version 10.0 (Windows 10 or greater), amd64 executable
2023-05-07 14:09:36 library versions: OpenSSL 3.1.0 14 Mar 2023, LZO 2.10
2023-05-07 14:09:36 DCO version: v0
2023-05-07 14:09:40 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:40 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-07 14:09:40 UDP link local: (not bound)
2023-05-07 14:09:40 UDP link remote: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:40 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-05-07 14:09:40 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 14:09:41 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 14:09:41 ERROR: Failed to apply push options
2023-05-07 14:09:41 Failed to open tun/tap interface
2023-05-07 14:09:41 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 14:09:42 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:42 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-07 14:09:42 UDP link local: (not bound)
2023-05-07 14:09:42 UDP link remote: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:42 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 14:09:44 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 14:09:44 ERROR: Failed to apply push options
2023-05-07 14:09:44 Failed to open tun/tap interface
2023-05-07 14:09:44 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 14:09:45 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:45 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-07 14:09:45 UDP link local: (not bound)
2023-05-07 14:09:45 UDP link remote: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:47 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 14:09:49 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 14:09:49 ERROR: Failed to apply push options
2023-05-07 14:09:49 Failed to open tun/tap interface
2023-05-07 14:09:49 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 14:09:50 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:50 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-07 14:09:50 UDP link local: (not bound)
2023-05-07 14:09:50 UDP link remote: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:50 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 14:09:51 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 14:09:51 ERROR: Failed to apply push options
2023-05-07 14:09:51 Failed to open tun/tap interface
2023-05-07 14:09:51 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 14:09:52 TCP/UDP: Preserving recently used remote address: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:52 ovpn-dco device [OpenVPN Data Channel Offload] opened
2023-05-07 14:09:52 UDP link local: (not bound)
2023-05-07 14:09:52 UDP link remote: [AF_INET]74.88.40.168:1194
2023-05-07 14:09:52 [RT-AX3000] Peer Connection Initiated with [AF_INET]74.88.40.168:1194
2023-05-07 14:09:54 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-05-07 14:09:54 ERROR: Failed to apply push options
2023-05-07 14:09:54 Failed to open tun/tap interface
2023-05-07 14:09:54 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-05-07 14:09:55 SIGTERM[hard,init_instance] received, process exiting

[becm]

In the log, OpenVPN tells you to set data-ciphers accordingly in your client config (twice).
If you have access to the server config, allowing for a more modern cipher would of course be preferable.