Tls Error: Reading Acknowledgement Record From Packet

While setting up OpenVPN I came accross some common errors or workarounds that make life easier. To get in easier to remember these I take documented them in this blog. Maybe they are useful for others as well.

Remove pass phrase

In case you want to remove the laissez passer phrase from the server fundamental to get in easiert to commencement the OpenVPN server function, use the following command:

mv server.key server.key.orig openssl rsa -in server.cardinal.orig -out server.primal

You'll have to enter 1 more than time the laissez passer phrase of the key, then a new server.key file is written without the pass phrase. Y'all can see this when looking into the key files.

With laissez passer phrase:

Note: file starts with: Brainstorm ENCRYPTED PRIVATE KEY

Without pass phrase:

Note: file starts with: BEGIN RSA Individual Key

Run OpenVPN as a service on Linux

Afterwards installing openvpn via yum on AWS AMI Linux, a service script is also installed. How the file works and tin can be activated is written in the file itself:

more /etc/init.d/openvpn

The file should already be copied past yum to /etc/rc.d/init.d/openvpn

Activate the service

chkconfig

Bank check whether or not openvpn is already configured to run as a service. For each run level, the status is either on or off. In case of on, openvpn is already configured to run as a service. In this example, opevpn is not configured to run as a service in any runlevel.

sudo chkconfig --add openvpn

sudo chkconfig openvpn on

OpenVPN will now exist started as a service in the run levels ii, three, 4 and 5. Output of openvpn is then written to /var/log/messages

sudo tail -f /var/log/letters

Systemd

To beginning and control openvpn via systemd. Check status of openvpn.

sudo systemctl status openvpn

Edit service configuration

sudo vim /etc/default/openvpn

Insert the client configuration to offset automatically. Hither, I am going to start client1.conf:

AUTOSTART="client1"

Starting time service

sudo systemctl start openvpn sudo systemctl condition openvpn

Solving common OpenVPN connexion error message

Some data on how to solve common OpenVPN mistake message on the server and client. About occur when trying to kickoff OpenVPN for the first time.

TA.Fundamental

Client starts connecting merely no connection is established.

Error bulletin

TLS Fault: cannot locate HMAC in incoming packet from [AF_INET]

Cause

Server is configured to use ta.fundamental.

Solution

Copy the ta.key into the openvpn configuration directory and specify its location in the conf file.

Cipher last failed

OpenVPN server accepts a client connection, simply communication fails.

Error message

Authenticate/Decrypt packet mistake: cipher final failed

Cause

Server and client are using unlike algorithms for encryption and decryption. On the server, the log gives more than information:

WARNING: 'cypher' is used inconsistently, local='nix AES-256-CBC', remote='zippo BF-CBC'

Solution

Server uses AES-256-CBC, while the client is using BF-CBC. Conform the customer configuration in client.conf. Insert aught AES-256-CBC in client.conf

Other parameters to adjust

During first startup, some alert bulletin may exist written on the server log. Near common they refer to link-mtu, nada, keysize or comp-lzo.

Warning: 'link-mtu' is used inconsistently, local='link-mtu 1557', remote='link-mtu 1542' WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128' WARNING: 'comp-lzo' is present in remote config only missing in local config, remote='comp-lzo'

Solution

Suit the parameters in the client.conf file and so that they match the server configuration. Also skillful to check this fashion if a not controlled/configured client is connecting to your server.

Link-mtu

Configure the client to use the aforementioned mtu size as the server. Insert parameter link-mtu into client.conf.

link-mtu 1557

Keysize

Keysize used by customer and server should exist the same. Insert parameter keysize into client.conf.

keysize 256

Comp-lzo

Uncomment the parameter in server.conf.

rextheack.blogspot.com

Source: https://www.itsfullofstars.de/2018/04/setup-openvpn-troubleshooting/

Share this post