Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.6 cant get openvpn working

    Scheduled Pinned Locked Moved
    OpenVPN
    3
    32
    3.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Honeybadger @JKnott
      last edited by

      @jknott now I'm getting :
      Mar 13 22:01:44 openvpn 49042 192.168.1.178:32991 write UDPv6: Can't assign requested address (code=49)
      Mar 13 22:01:43 openvpn 49042 192.168.1.178:51280 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:51280 (via ::ffff:184.103.180.206%bridge0)
      Mar 13 22:01:43 openvpn 49042 192.168.1.178:51280 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647234095) 2022-03-13 22:01:35 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
      Mar 13 22:01:42 openvpn 49042 192.168.1.178:51280 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:51280 (via ::ffff:184.103.180.206%bridge0)
      Mar 13 22:01:42 openvpn 49042 192.168.1.178:51280 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647234095) 2022-03-13 22:01:35 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
      Mar 13 22:01:41 openvpn 49042 192.168.1.178:51280 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:51280 (via ::ffff:184.103.180.206%bridge0)
      Mar 13 22:01:41 openvpn 49042 192.168.1.178:51280 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647234095) 2022-03-13 22:01:35 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
      Mar 13 22:01:40 openvpn 49042 192.168.1.178:51280 write UDPv6: Can't assign requested address (code=49)
      Mar 13 22:01:40 openvpn 49042 192.168.1.178:51280 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:51280 (via ::ffff:184.103.180.206%bridge0)
      Mar 13 22:01:40 openvpn 49042 192.168.1.178:51280 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647234095) 2022-03-13 22:01:35 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
      Mar 13 22:01:39 openvpn 49042 192.168.1.178:51280 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:51280 (via ::ffff:184.103.180.206%bridge0)

      GertjanG 2 Replies Last reply Reply Quote 0
      • GertjanG
        Gertjan @Honeybadger
        last edited by Gertjan

        @honeybadger
        See for example Openvpn[50203]: Authenticate/Decrypt packet error ?.

        I've found the same error, just ones, last month in my log file :

        260b8995-73ba-4320-a38c-418f42130204-image.png

        What is this :

        11d5c0d8-d9e9-4b8f-970b-15939e2a2e8f-image.png

        Bridge ?
        What does bridge0 means ? Cab you tell more about your setup ?
        Maybe it's not important / not related.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        H 1 Reply Last reply Reply Quote 0
        • H
          Honeybadger @Gertjan
          last edited by

          @gertjan i think bridge is my wifi bridgs but it works so...

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @Honeybadger
            last edited by

            @honeybadger

            pfSense, or OpenVPN, isn't aware of 'wifi'.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            H 1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott @Honeybadger
              last edited by

              @honeybadger

              Your problem appears to be different from mine.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              1 Reply Last reply Reply Quote 0
              • H
                Honeybadger @Gertjan
                last edited by

                @gertjan i know, why i have a bridge.

                Still, any idea why I can't get openvpn working?

                1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @Honeybadger
                  last edited by

                  @honeybadger said in 2.6 cant get openvpn working:

                  write UDPv6: Can't assign requested address (code=49)
                  .... [AF_INET6]::ffff:192.168.1.178:51280 (via ::ffff:184.103.180.206%bridge0) ...

                  I have :

                  UDPv4 link local (bound): [AF_INET]192.168.10.3:1194

                  that is : I use IPv4.
                  I've nothing against IPv6 .... but try making IPv4 working first.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  H 2 Replies Last reply Reply Quote 0
                  • H
                    Honeybadger @Gertjan
                    last edited by

                    This post is deleted!
                    1 Reply Last reply Reply Quote 0
                    • H
                      Honeybadger @Gertjan
                      last edited by

                      @gertjan ya still not working.

                      I'm using the wizard and i could have sworn there was a option to choose v4 or v6, cant fine it now.

                      Thanks everyone for the help!

                      H 1 Reply Last reply Reply Quote 0
                      • H
                        Honeybadger @Honeybadger
                        last edited by

                        Remote:

                        09:21:46.726 -- ----- OpenVPN Start -----

                        09:21:46.727 -- EVENT: CORE_THREAD_ACTIVE

                        09:21:46.730 -- OpenVPN core 3.git::662eae9a:Release android arm64 64-bit PT_PROXY

                        09:21:46.893 -- Frame=512/2048/512 mssfix-ctrl=1250

                        09:21:46.897 -- UNUSED OPTIONS
                        1 [persist-tun]
                        2 [persist-key]
                        3 [data-ciphers] [AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC]
                        4 [data-ciphers-fallback] [AES-256-CBC]
                        6 [tls-client]
                        8 [resolv-retry] [infinite]
                        10 [nobind]
                        11 [verify-x509-name] [OpenVPN_CA] [name]
                        13 [pkcs12] [nehwon-udp-1194-techbadgertablet.p12]
                        17 [explicit-exit-notify]

                        09:21:46.898 -- EVENT: RESOLVE

                        09:21:46.951 -- Contacting 184.103.180.206:1194 via UDP

                        09:21:46.951 -- EVENT: WAIT

                        09:21:46.955 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                        09:21:56.900 -- Server poll timeout, trying next remote entry...

                        09:21:56.902 -- EVENT: RECONNECTING

                        09:21:56.908 -- EVENT: RESOLVE

                        09:21:56.945 -- Contacting 184.103.180.206:1194 via UDP

                        09:21:56.946 -- EVENT: WAIT

                        09:21:56.952 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                        09:22:06.903 -- Server poll timeout, trying next remote entry...

                        09:22:06.905 -- EVENT: RECONNECTING

                        09:22:06.914 -- EVENT: RESOLVE

                        09:22:06.943 -- Contacting 184.103.180.206:1194 via UDP

                        09:22:06.943 -- EVENT: WAIT

                        09:22:06.946 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                        09:22:16.907 -- Server poll timeout, trying next remote entry...

                        09:22:16.908 -- EVENT: RECONNECTING

                        09:22:16.923 -- EVENT: RESOLVE

                        09:22:16.928 -- Contacting 184.103.180.206:1194 via UDP

                        09:22:16.929 -- EVENT: WAIT

                        09:22:16.937 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                        Server:
                        192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:22:00 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:22:00 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:59 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:59 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:59 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                        Mar 15 09:21:58 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:58 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:58 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:52775 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:57 openvpn 49042 192.168.1.178:42120 write UDPv6: Can't assign requested address (code=49)
                        Mar 15 09:21:57 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:57 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:56 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:56 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:55 openvpn 49042 192.168.1.178:42120 write UDPv6: Can't assign requested address (code=49)
                        Mar 15 09:21:54 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:54 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:54 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:52775 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:53 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:53 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:52 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:52 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:52 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:52775 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:51 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                        Mar 15 09:21:51 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:51 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:50 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:50 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:49 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:49 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:48 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:48 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:47 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                        Mar 15 09:21:47 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:47 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:46 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                        Mar 15 09:21:46 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                        Mar 15 09:21:45 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                        Mar 15 09:16:22 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:49629 (via ::ffff:184.103.180.206%bridge0

                        As you can see, v4. Ideas?

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @Honeybadger
                          last edited by

                          @honeybadger

                          You could do what is advised :

                          see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

                          And if your not using IPv6 : why :

                          write UDPv6: Can't assign requested address (code=49)

                          Can you detail your OpenVPN server settings ?
                          Your WAN is a normal interface - no VLAN, of whatever this " %bridge0) " is.
                          What for device are you using ?

                          @honeybadger said in 2.6 cant get openvpn working:

                          TLS Error: cannot locate HMAC in incoming packet from

                          Google this one. I find, for example : How to fix OpenVPN “TLS Error: cannot locate HMAC in incoming packet from …” which says to me that the client config used doesn't correspond with what you exported in the pfSense GUI.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          H 1 Reply Last reply Reply Quote 0
                          • H
                            Honeybadger @Gertjan
                            last edited by

                            @gertjan i followed these instructions: https://www.informaticar.net/how-to-setup-openvpn-on-pfsense/

                            I thought I set your advisments. Thanks for your time.

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @Honeybadger
                              last edited by

                              @honeybadger said in 2.6 cant get openvpn working:

                              https://www.informaticar.net/how-to-setup-openvpn-on-pfsense/

                              You can use https://what-ever-I-can-find-on-the-internet.tld but why wouldn't you also use these sources :

                              Docs » pfSense® software » Virtual Private Networks

                              This video "a working OpenVPN in 5 minutes", made by the ones who build pfSense.
                              Configuring OpenVPN Remote Access in pfSense Software
                              Actually, all the OpenVPN video @Youtube -> Netgate, even the ones that are x years old are very important as they show examples.

                              If you really used a documentation, based on a very old pfSense version and also old OpenVPN (2.3.x or even before ?), it's a 100 %chance that things won't work out.
                              OpenVPN is security related so there are important changes a couple of times each year.

                              Normally, I build a "as per author instructions" setup, and this if everything works.
                              Every error or warning shown in the logs have to be considered as show stoppers until, from official source, they can be allowed.
                              Then, and only then, I add my own personnel settings, options and I test them one by one.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              H 1 Reply Last reply Reply Quote 0
                              • H
                                Honeybadger @Gertjan
                                last edited by

                                @gertjan i read through your recommendated docs and videos.

                                I dont see the difference btween my install docs and yours, please point out the missing steps/data?

                                Thanks

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @Honeybadger
                                  last edited by

                                  @honeybadger said in 2.6 cant get openvpn working:

                                  see the difference btween my install docs and yours

                                  I'm not using or referring 'foreign' sources, as I only use the originals.
                                  If there are differences, as you use older documentation, that's up to you to find them ;)

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  H 1 Reply Last reply Reply Quote 0
                                  • H
                                    Honeybadger @Gertjan
                                    last edited by

                                    @gertjan i did follow your recommended instruction at pfsense, ended with the same problem. I couldn't find anything different in setup between my original and your instructions.

                                    GertjanG 1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @Honeybadger
                                      last edited by

                                      @honeybadger said in 2.6 cant get openvpn working:

                                      same problem

                                      You mean : you used Configuring OpenVPN Remote Access in pfSense Software and the instructions in that video didn't work right away ?

                                      There are some requirements that are not mentioned :

                                      The latest pfSense version.
                                      Default pfSense setup (no fancy routing, no VLAN, no other packages except the pfSEnse "openvpn-client-export" package.
                                      A OpenVPN client version that uses 2.5.x (pfSense 2.6.0 is using OenVPN 2.5.4)

                                      Anyway, I'm curious now. I"ll blow away my settings @home - reboot to default, assign interfaces, change the password and stop there. I'll play back the video.
                                      I'll be using this client OpenVPN Connect Phone or PC version.

                                      Since Mars 2020, thousands are using OpenVPN as we all had to work from home.

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      H 2 Replies Last reply Reply Quote 0
                                      • H
                                        Honeybadger @Gertjan
                                        last edited by

                                        @gertjan excellent!

                                        Thankyou for your time!

                                        I look forward to your reply!

                                        Thank you thank you thank you!

                                        1 Reply Last reply Reply Quote 0
                                        • H
                                          Honeybadger @Gertjan
                                          last edited by

                                          @gertjan okay, deleated all users and server and user certs.

                                          Followed: https://www.wundertech.net/how-to-set-up-openvpn-on-pfsense
                                          Valid as of February.

                                          Server: Mar 19 19:50:19 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                          Mar 19 19:50:02 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                          Mar 19 19:49:55 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                          Mar 19 19:49:51 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                          Mar 19 19:49:48 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                          Mar 19 19:49:09 openvpn 24728 192.168.1.178:46841 TLS Error: TLS handshake failed
                                          Mar 19 19:49:09 openvpn 24728 192.168.1.178:46841 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                          Mar 19 19:48:59 openvpn 24728 192.168.1.178:45857 TLS Error: TLS handshake failed
                                          Mar 19 19:48:59 openvpn 24728 192.168.1.178:45857 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                          Mar 19 19:48:49 openvpn 24728 192.168.1.178:59422 TLS Error: TLS handshake failed
                                          Mar 19 19:48:49 openvpn 24728 192.168.1.178:59422 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                          Mar 19 19:48:39 openvpn 24728 192.168.1.178:41320 TLS Error: TLS handshake failed
                                          Mar 19 19:48:39 openvpn 24728 192.168.1.178:41320 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                          Mar 19 19:48:30 openvpn 24728 192.168.1.178:54456 TLS Error: TLS handshake failed
                                          Mar 19 19:48:30 openvpn 24728 192.168.1.178:54456 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                          Mar 19 19:48:19 openvpn 24728 192.168.1.178:33735 TLS Error: TLS handshake failed
                                          Mar 19 19:48:19 openvpn 24728 192.168.1.178:33735 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                          Mar 19 19:48:18 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:18 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:17 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:17 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:16 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:16 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:15 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:15 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:14 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:14 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:13 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:13 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:12 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:12 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:11 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:11 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:10 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                          Mar 19 19:48:10 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:08 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                          Mar 19 19:48:08 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:07 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                          Mar 19 19:48:07 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:06 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                          Mar 19 19:48:06 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:05 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                          Mar 19 19:48:05 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:04 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                          Mar 19 19:48:04 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                          Mar 19 19:48:03 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857

                                          Help please?

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @Honeybadger
                                            last edited by

                                            On the way - as soon as I get @home, i'll do a test setup.

                                            Your are testing with 2 IP's on the same network. 192.168.1.178 to 192.168.1.172, I've never tested that, and if it would connect, it would probably still fail.
                                            The situation should be : an openvpn server listening on the WAN port. This WAN port could be RFC1918 and you could have an upstream "ISP" router with the "UDP 1194" port natted to pfSense.
                                            Use your phone with the data carrier (3G/4G/LTE/...) , not the Wifi (!) so it use an arbitrary 'outside' IP, not some local RFC1918.

                                            And again :

                                            openvpn TLS Error: cannot locate HMAC in incoming packet from

                                            shows many examples saying just one thing : HMAC on server and client are not the same.

                                            Also : Your OpenCVPN server version is 2.5.4 - what are you using as a client - and what version ?

                                            Just to be sure : check your NTP setup on all devices. Time should be the same, like within a second or so.

                                            Post your openvpn server config file ( Folder /var/etc/openvpn/server1 - the config.opvn file)

                                            How did you create the client config file ?
                                            No client override instruction ? ( here : VPN > OpenVPN > Client Specific Overrides )

                                            What have you checked on the VPN > OpenVPN > Client Export Utility page ?

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            H 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post