Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.6 cant get openvpn working

    Scheduled Pinned Locked Moved OpenVPN
    32 Posts 3 Posters 6.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Honeybadger @Gertjan
      last edited by

      @gertjan i think bridge is my wifi bridgs but it works so...

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @Honeybadger
        last edited by

        @honeybadger

        pfSense, or OpenVPN, isn't aware of 'wifi'.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        H 1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott @Honeybadger
          last edited by

          @honeybadger

          Your problem appears to be different from mine.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • H
            Honeybadger @Gertjan
            last edited by

            @gertjan i know, why i have a bridge.

            Still, any idea why I can't get openvpn working?

            1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @Honeybadger
              last edited by

              @honeybadger said in 2.6 cant get openvpn working:

              write UDPv6: Can't assign requested address (code=49)
              .... [AF_INET6]::ffff:192.168.1.178:51280 (via ::ffff:184.103.180.206%bridge0) ...

              I have :

              UDPv4 link local (bound): [AF_INET]192.168.10.3:1194

              that is : I use IPv4.
              I've nothing against IPv6 .... but try making IPv4 working first.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              H 2 Replies Last reply Reply Quote 0
              • H
                Honeybadger @Gertjan
                last edited by

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • H
                  Honeybadger @Gertjan
                  last edited by

                  @gertjan ya still not working.

                  I'm using the wizard and i could have sworn there was a option to choose v4 or v6, cant fine it now.

                  Thanks everyone for the help!

                  H 1 Reply Last reply Reply Quote 0
                  • H
                    Honeybadger @Honeybadger
                    last edited by

                    Remote:

                    09:21:46.726 -- ----- OpenVPN Start -----

                    09:21:46.727 -- EVENT: CORE_THREAD_ACTIVE

                    09:21:46.730 -- OpenVPN core 3.git::662eae9a:Release android arm64 64-bit PT_PROXY

                    09:21:46.893 -- Frame=512/2048/512 mssfix-ctrl=1250

                    09:21:46.897 -- UNUSED OPTIONS
                    1 [persist-tun]
                    2 [persist-key]
                    3 [data-ciphers] [AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC]
                    4 [data-ciphers-fallback] [AES-256-CBC]
                    6 [tls-client]
                    8 [resolv-retry] [infinite]
                    10 [nobind]
                    11 [verify-x509-name] [OpenVPN_CA] [name]
                    13 [pkcs12] [nehwon-udp-1194-techbadgertablet.p12]
                    17 [explicit-exit-notify]

                    09:21:46.898 -- EVENT: RESOLVE

                    09:21:46.951 -- Contacting 184.103.180.206:1194 via UDP

                    09:21:46.951 -- EVENT: WAIT

                    09:21:46.955 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                    09:21:56.900 -- Server poll timeout, trying next remote entry...

                    09:21:56.902 -- EVENT: RECONNECTING

                    09:21:56.908 -- EVENT: RESOLVE

                    09:21:56.945 -- Contacting 184.103.180.206:1194 via UDP

                    09:21:56.946 -- EVENT: WAIT

                    09:21:56.952 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                    09:22:06.903 -- Server poll timeout, trying next remote entry...

                    09:22:06.905 -- EVENT: RECONNECTING

                    09:22:06.914 -- EVENT: RESOLVE

                    09:22:06.943 -- Contacting 184.103.180.206:1194 via UDP

                    09:22:06.943 -- EVENT: WAIT

                    09:22:06.946 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                    09:22:16.907 -- Server poll timeout, trying next remote entry...

                    09:22:16.908 -- EVENT: RECONNECTING

                    09:22:16.923 -- EVENT: RESOLVE

                    09:22:16.928 -- Contacting 184.103.180.206:1194 via UDP

                    09:22:16.929 -- EVENT: WAIT

                    09:22:16.937 -- Connecting to [techbadger.ddns.net]:1194 (184.103.180.206) via UDPv4

                    Server:
                    192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:22:00 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:22:00 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:59 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:59 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:59 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                    Mar 15 09:21:58 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:58 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:58 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:52775 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:57 openvpn 49042 192.168.1.178:42120 write UDPv6: Can't assign requested address (code=49)
                    Mar 15 09:21:57 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:57 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:56 openvpn 49042 192.168.1.178:42120 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:42120 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:56 openvpn 49042 192.168.1.178:42120 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361316) 2022-03-15 09:21:56 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:55 openvpn 49042 192.168.1.178:42120 write UDPv6: Can't assign requested address (code=49)
                    Mar 15 09:21:54 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:54 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:54 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:52775 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:53 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:53 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:52 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:52 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:52 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:52775 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:51 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                    Mar 15 09:21:51 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:51 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:50 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:50 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:49 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:49 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:48 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:48 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:47 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                    Mar 15 09:21:47 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:47 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:46 openvpn 49042 192.168.1.178:59407 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:59407 (via ::ffff:184.103.180.206%bridge0)
                    Mar 15 09:21:46 openvpn 49042 192.168.1.178:59407 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647361306) 2022-03-15 09:21:46 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                    Mar 15 09:21:45 openvpn 49042 192.168.1.178:59407 write UDPv6: Can't assign requested address (code=49)
                    Mar 15 09:16:22 openvpn 49042 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:49629 (via ::ffff:184.103.180.206%bridge0

                    As you can see, v4. Ideas?

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @Honeybadger
                      last edited by

                      @honeybadger

                      You could do what is advised :

                      see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

                      And if your not using IPv6 : why :

                      write UDPv6: Can't assign requested address (code=49)

                      Can you detail your OpenVPN server settings ?
                      Your WAN is a normal interface - no VLAN, of whatever this " %bridge0) " is.
                      What for device are you using ?

                      @honeybadger said in 2.6 cant get openvpn working:

                      TLS Error: cannot locate HMAC in incoming packet from

                      Google this one. I find, for example : How to fix OpenVPN “TLS Error: cannot locate HMAC in incoming packet from …” which says to me that the client config used doesn't correspond with what you exported in the pfSense GUI.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      H 1 Reply Last reply Reply Quote 0
                      • H
                        Honeybadger @Gertjan
                        last edited by

                        @gertjan i followed these instructions: https://www.informaticar.net/how-to-setup-openvpn-on-pfsense/

                        I thought I set your advisments. Thanks for your time.

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @Honeybadger
                          last edited by

                          @honeybadger said in 2.6 cant get openvpn working:

                          https://www.informaticar.net/how-to-setup-openvpn-on-pfsense/

                          You can use https://what-ever-I-can-find-on-the-internet.tld but why wouldn't you also use these sources :

                          Docs » pfSense® software » Virtual Private Networks

                          This video "a working OpenVPN in 5 minutes", made by the ones who build pfSense.
                          Configuring OpenVPN Remote Access in pfSense Software
                          Actually, all the OpenVPN video @Youtube -> Netgate, even the ones that are x years old are very important as they show examples.

                          If you really used a documentation, based on a very old pfSense version and also old OpenVPN (2.3.x or even before ?), it's a 100 %chance that things won't work out.
                          OpenVPN is security related so there are important changes a couple of times each year.

                          Normally, I build a "as per author instructions" setup, and this if everything works.
                          Every error or warning shown in the logs have to be considered as show stoppers until, from official source, they can be allowed.
                          Then, and only then, I add my own personnel settings, options and I test them one by one.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          H 1 Reply Last reply Reply Quote 0
                          • H
                            Honeybadger @Gertjan
                            last edited by

                            @gertjan i read through your recommendated docs and videos.

                            I dont see the difference btween my install docs and yours, please point out the missing steps/data?

                            Thanks

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @Honeybadger
                              last edited by

                              @honeybadger said in 2.6 cant get openvpn working:

                              see the difference btween my install docs and yours

                              I'm not using or referring 'foreign' sources, as I only use the originals.
                              If there are differences, as you use older documentation, that's up to you to find them ;)

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              H 1 Reply Last reply Reply Quote 0
                              • H
                                Honeybadger @Gertjan
                                last edited by

                                @gertjan i did follow your recommended instruction at pfsense, ended with the same problem. I couldn't find anything different in setup between my original and your instructions.

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @Honeybadger
                                  last edited by

                                  @honeybadger said in 2.6 cant get openvpn working:

                                  same problem

                                  You mean : you used Configuring OpenVPN Remote Access in pfSense Software and the instructions in that video didn't work right away ?

                                  There are some requirements that are not mentioned :

                                  The latest pfSense version.
                                  Default pfSense setup (no fancy routing, no VLAN, no other packages except the pfSEnse "openvpn-client-export" package.
                                  A OpenVPN client version that uses 2.5.x (pfSense 2.6.0 is using OenVPN 2.5.4)

                                  Anyway, I'm curious now. I"ll blow away my settings @home - reboot to default, assign interfaces, change the password and stop there. I'll play back the video.
                                  I'll be using this client OpenVPN Connect Phone or PC version.

                                  Since Mars 2020, thousands are using OpenVPN as we all had to work from home.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  H 2 Replies Last reply Reply Quote 0
                                  • H
                                    Honeybadger @Gertjan
                                    last edited by

                                    @gertjan excellent!

                                    Thankyou for your time!

                                    I look forward to your reply!

                                    Thank you thank you thank you!

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      Honeybadger @Gertjan
                                      last edited by

                                      @gertjan okay, deleated all users and server and user certs.

                                      Followed: https://www.wundertech.net/how-to-set-up-openvpn-on-pfsense
                                      Valid as of February.

                                      Server: Mar 19 19:50:19 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                      Mar 19 19:50:02 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                      Mar 19 19:49:55 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                      Mar 19 19:49:51 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                      Mar 19 19:49:48 openvpn 24728 TLS Error: cannot locate HMAC in incoming packet from [AF_INET6]::ffff:192.168.1.172:50463
                                      Mar 19 19:49:09 openvpn 24728 192.168.1.178:46841 TLS Error: TLS handshake failed
                                      Mar 19 19:49:09 openvpn 24728 192.168.1.178:46841 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                      Mar 19 19:48:59 openvpn 24728 192.168.1.178:45857 TLS Error: TLS handshake failed
                                      Mar 19 19:48:59 openvpn 24728 192.168.1.178:45857 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                      Mar 19 19:48:49 openvpn 24728 192.168.1.178:59422 TLS Error: TLS handshake failed
                                      Mar 19 19:48:49 openvpn 24728 192.168.1.178:59422 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                      Mar 19 19:48:39 openvpn 24728 192.168.1.178:41320 TLS Error: TLS handshake failed
                                      Mar 19 19:48:39 openvpn 24728 192.168.1.178:41320 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                      Mar 19 19:48:30 openvpn 24728 192.168.1.178:54456 TLS Error: TLS handshake failed
                                      Mar 19 19:48:30 openvpn 24728 192.168.1.178:54456 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                      Mar 19 19:48:19 openvpn 24728 192.168.1.178:33735 TLS Error: TLS handshake failed
                                      Mar 19 19:48:19 openvpn 24728 192.168.1.178:33735 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
                                      Mar 19 19:48:18 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:18 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:17 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:17 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:16 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:16 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:15 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:15 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:14 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:14 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:13 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:13 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:12 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:12 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:11 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:11 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:10 openvpn 24728 192.168.1.178:46841 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:46841
                                      Mar 19 19:48:10 openvpn 24728 192.168.1.178:46841 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744490) 2022-03-19 19:48:10 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:08 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                      Mar 19 19:48:08 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:07 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                      Mar 19 19:48:07 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:06 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                      Mar 19 19:48:06 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:05 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                      Mar 19 19:48:05 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:04 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857
                                      Mar 19 19:48:04 openvpn 24728 192.168.1.178:45857 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1647744480) 2022-03-19 19:48:00 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                      Mar 19 19:48:03 openvpn 24728 192.168.1.178:45857 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:192.168.1.178:45857

                                      Help please?

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @Honeybadger
                                        last edited by

                                        On the way - as soon as I get @home, i'll do a test setup.

                                        Your are testing with 2 IP's on the same network. 192.168.1.178 to 192.168.1.172, I've never tested that, and if it would connect, it would probably still fail.
                                        The situation should be : an openvpn server listening on the WAN port. This WAN port could be RFC1918 and you could have an upstream "ISP" router with the "UDP 1194" port natted to pfSense.
                                        Use your phone with the data carrier (3G/4G/LTE/...) , not the Wifi (!) so it use an arbitrary 'outside' IP, not some local RFC1918.

                                        And again :

                                        openvpn TLS Error: cannot locate HMAC in incoming packet from

                                        shows many examples saying just one thing : HMAC on server and client are not the same.

                                        Also : Your OpenCVPN server version is 2.5.4 - what are you using as a client - and what version ?

                                        Just to be sure : check your NTP setup on all devices. Time should be the same, like within a second or so.

                                        Post your openvpn server config file ( Folder /var/etc/openvpn/server1 - the config.opvn file)

                                        How did you create the client config file ?
                                        No client override instruction ? ( here : VPN > OpenVPN > Client Specific Overrides )

                                        What have you checked on the VPN > OpenVPN > Client Export Utility page ?

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        H 1 Reply Last reply Reply Quote 0
                                        • H
                                          Honeybadger @Gertjan
                                          last edited by Honeybadger

                                          @gertjan i created with the openvpn export wizard.

                                          Latest android openvpn client and latest open wizard verson 1.6_4.

                                          My pfsense is 2.6.0
                                          Android client is 3.2.5(7182)
                                          I looked in /var/etc/openvpn/server1 butdont see a config file. (ovpn)
                                          No overrides

                                          Thanks for the help

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @Honeybadger
                                            last edited by

                                            @honeybadger said in 2.6 cant get openvpn working:

                                            I looked in /var/etc/openvpn/server1 butdont see a config file. (ovpn)

                                            or server2 - or 3 etc - depedning on the number of openvpn servers you have (had) set up :

                                            44069e0b-b3a6-463f-b56d-5f96428fb527-image.png

                                            a config.ovpn file must exist, otherwise the openvpn server can't run.

                                            I've just created my home openvpn server according to the Netgate video.

                                            My tunnel network is 192.168.80.0/24
                                            I use only IPv4.

                                            What I did that not in the video :
                                            I had to port NAT my ISP router : port 1194 UDP => to my pfSense.
                                            I assigned a OpenVPNserver as an interface :

                                            338788c6-d7f8-45a9-a7f5-b3d5b9636f6f-image.png

                                            and I moved the Wizard generated firewall rule from the OpenVPN to the new OPENVPNSERVER tab :

                                            174e4408-9779-44ba-b465-566330bd9be2-image.png

                                            I opened the resolver settings page, saw that in the incoming and outgoing connections my new OPENVPNSERVER was listed among the others.
                                            I restarted the Resolver - now it also listens on the OpenVPN network.

                                            I also visited Services > NTP > Settings and added OPENVPNSERVER to the "Interfaces" box so my openvpn clients can connect a NTP source.

                                            I don't use "User auth", but TLS only, so without user/password :

                                            fdae2592-8fe3-42c7-b90b-a850b6f282df-image.png

                                            so I added a user called 'vpn' with a cert based on the OpenVPN server cert :

                                            (on the user Manager page : )

                                            dd0f2313-291a-4707-bb30-6293b708384c-image.png

                                            I installed the OpenVPN export package, and saw my openvpn user 'vpn' listed :

                                            5f834bdf-6354-4f93-a8a5-21bea8e658b2-image.png

                                            Exported (dwonloaded) the "OpenVPN Connect (OS/Android) openvpn client config file.

                                            Mailed the client config myself, imported it into my iPhone.

                                            I also double checked that the DDNS URL that points to my WAN IP is correct.

                                            I connected just fine.
                                            No errors in the OpenVPN server log, except the two classic wartnings :

                                            WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1553'

                                            No issues on the client side.
                                            I could visit the pfSense WebGUI, and visit any other web server on my LAN (10.0.0.0/24) and whatever Internet site, like https://forum.netgate.com.

                                            Extra OpenVPN server settings :

                                            3f05a191-1a3f-4d3a-9a84-a3c6b953b3d5-image.png

                                            As said earlier, I use the OpenCONNECT app ( made by the OpenVPN authors).
                                            Its compatible with the OpenServer code pfSense uses (version 2.5.4).

                                            b87a2f4c-4fee-4ac0-8c5b-1106d332aef3-image.png

                                            I did not see time or 'replay' issues, neither HMAC errors.

                                            I de activated the Wifi on my phone, so I was really accessing the OpenVPN server from the Internet.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            H 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.