Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Express VPN Received control message: AUTH_FAILED

    Scheduled Pinned Locked Moved OpenVPN
    21 Posts 4 Posters 3.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jegavelan @KOM
      last edited by Jegavelan

      @kom said in Express VPN Received control message: AUTH_FAILED:

      "

      Tried that already no luck.

      dev tun
      fast-io
      persist-key
      persist-tun
      nobind
      remote usa-newyork-ca-version-2.expressnetw.com 1195
      remote-random
      pull
      comp-lzo no
      tls-client
      verify-x509-name Server name-prefix
      
      
      
      KOMK 1 Reply Last reply Reply Quote 0
      • KOMK
        KOM @Jegavelan
        last edited by KOM

        @jegavelan said in Express VPN Received control message: AUTH_FAILED:

        comp-lzo no

        Yours is set to Adaptive. I would try disabling compression entirely and see if that helps.

        Edit: You might want to delete your key information from your .ovpn post. Remove all from <cert> down.

        J 1 Reply Last reply Reply Quote 0
        • J
          Jegavelan @KOM
          last edited by

          @kom Disabled it , still same error message.

          KOMK 1 Reply Last reply Reply Quote 0
          • KOMK
            KOM @Jegavelan
            last edited by

            @jegavelan Which version of pfSense is this?

            J 1 Reply Last reply Reply Quote 0
            • J
              Jegavelan @KOM
              last edited by

              @kom

              f182a032-89bb-45ff-842d-bcf43301deaf-image.png

              KOMK 1 Reply Last reply Reply Quote 0
              • KOMK
                KOM @Jegavelan
                last edited by

                @jegavelan Didn't your original .ovpn file have a key-direction entry in it? I'm sure I saw that but it's not in your post above anymore.

                J 1 Reply Last reply Reply Quote 0
                • J
                  Jegavelan @KOM
                  last edited by

                  @kom

                  remote-random
                  pull
                  comp-lzo no
                  tls-client
                  verify-x509-name Server name-prefix
                  ns-cert-type server
                  key-direction 1
                  route-method exe
                  route-delay 2
                  tun-mtu 1500
                  fragment 1300
                  mssfix 1200
                  verb 3
                  cipher AES-256-CBC
                  keysize 256
                  auth SHA512
                  sndbuf 524288
                  rcvbuf 524288
                  auth-user-pass
                  
                  KOMK 1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM @Jegavelan
                    last edited by

                    @jegavelan Try manually setting your TLS key-direction to 1 instead of Use default direction

                    I'm grasping at straws at this point.

                    1 Reply Last reply Reply Quote 0
                    • J
                      Jegavelan
                      last edited by

                      @kom still no luck

                      KOMK 1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM @Jegavelan
                        last edited by

                        @jegavelan I don't have much else to add other than to contact ExpressVPN Support and ask them if they have more details from the server logs because the auth_fail is completely unexplained. Usually that error comes with extra details, and when it does not it's often a bad username or password.

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @KOM
                          last edited by Gertjan

                          These are my settings :

                          e6032528-ef38-4369-a560-7ab533187425-image.png

                          The created config file is :

                          dev ovpnc2
                          verb 3
                          dev-type tun
                          dev-node /dev/tun2
                          writepid /var/run/openvpn_client2.pid
                          #user nobody
                          #group nobody
                          script-security 3
                          daemon
                          keepalive 10 60
                          ping-timer-rem
                          persist-tun
                          persist-key
                          proto udp4
                          auth SHA512
                          up /usr/local/sbin/ovpn-linkup
                          down /usr/local/sbin/ovpn-linkdown
                          local 192.168.10.3
                          tls-client
                          client
                          lport 0
                          management /var/etc/openvpn/client2/sock unix
                          remote 45.91.22.2 1195 udp4
                          auth-user-pass /var/etc/openvpn/client2/up
                          capath /var/etc/openvpn/client2/ca
                          cert /var/etc/openvpn/client2/cert 
                          key /var/etc/openvpn/client2/key 
                          tls-auth /var/etc/openvpn/client2/tls-auth 1
                          data-ciphers AES-256-CBC
                          data-ciphers-fallback AES-256-CBC
                          allow-compression asym
                          comp-lzo yes
                          resolv-retry infinite
                          fast-io
                          sndbuf 524288
                          rcvbuf 524288
                          
                          verify-x509-name Server name-prefix;
                          remote-cert-tls server;
                          route-delay 2;
                          tun-mtu 1500;
                          fragment 1300;
                          mssfix 1450;
                          auth-nocache;
                          

                          Starting with "verify-x509-name Server name-prefix", these are the custom added commands.

                          Note : with the "qdqdqdqsdqsdqsdqsdqsdq" password (see image), I guess massive

                          AUTH: Received control message: AUTH_FAILED
                          

                          failures.

                          These :

                          dev ovpnc2
                          local 192.168.10.3
                          remote 45.91.22.2 1195 udp4
                          

                          are most surely different on your system.

                          The VPN client connected just fine :
                          Logs in reverse order :

                          2021-05-27 08:42:46.012571+02:00 	openvpn 	86900 	Initialization Sequence Completed
                          2021-05-27 08:42:44.586214+02:00 	openvpn 	86900 	/usr/local/sbin/ovpn-linkup ovpnc2 1500 1629 10.104.2.110 10.104.2.109 init
                          2021-05-27 08:42:44.581361+02:00 	openvpn 	86900 	/sbin/ifconfig ovpnc2 10.104.2.110 10.104.2.109 mtu 1500 netmask 255.255.255.255 up
                          2021-05-27 08:42:44.581222+02:00 	openvpn 	86900 	TUN/TAP device /dev/tun2 opened
                          2021-05-27 08:42:44.580968+02:00 	openvpn 	86900 	TUN/TAP device ovpnc2 exists previously, keep at program end
                          2021-05-27 08:42:44.580890+02:00 	openvpn 	86900 	Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
                          2021-05-27 08:42:44.580831+02:00 	openvpn 	86900 	Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
                          2021-05-27 08:42:44.580781+02:00 	openvpn 	86900 	Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
                          2021-05-27 08:42:44.580726+02:00 	openvpn 	86900 	Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
                          2021-05-27 08:42:44.580592+02:00 	openvpn 	86900 	Using peer cipher 'AES-256-CBC'
                          2021-05-27 08:42:44.580546+02:00 	openvpn 	86900 	OPTIONS IMPORT: adjusting link_mtu to 1629
                          2021-05-27 08:42:44.580496+02:00 	openvpn 	86900 	OPTIONS IMPORT: peer-id set
                          2021-05-27 08:42:44.580450+02:00 	openvpn 	86900 	OPTIONS IMPORT: --ifconfig/up options modified
                          2021-05-27 08:42:44.580390+02:00 	openvpn 	86900 	OPTIONS IMPORT: compression parms modified
                          2021-05-27 08:42:44.580338+02:00 	openvpn 	86900 	OPTIONS IMPORT: timers and/or timeouts modified
                          2021-05-27 08:42:44.580269+02:00 	openvpn 	86900 	Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
                          2021-05-27 08:42:44.580214+02:00 	openvpn 	86900 	Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
                          2021-05-27 08:42:44.580158+02:00 	openvpn 	86900 	Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
                          2021-05-27 08:42:44.580050+02:00 	openvpn 	86900 	PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.104.0.1,comp-lzo no,route 10.104.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.104.2.110 10.104.2.109,peer-id 64'
                          2021-05-27 08:42:44.557481+02:00 	openvpn 	86900 	SENT CONTROL [Server-2776-4a]: 'PUSH_REQUEST' (status=1)
                          2021-05-27 08:42:43.536122+02:00 	openvpn 	86900 	[Server-2776-4a] Peer Connection Initiated with [AF_INET]45.91.22.2:1195
                          2021-05-27 08:42:43.536062+02:00 	openvpn 	86900 	Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
                          2021-05-27 08:42:43.499590+02:00 	openvpn 	86900 	VERIFY OK: depth=0, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-2776-4a, emailAddress=support@expressvpn.com
                          2021-05-27 08:42:43.499537+02:00 	openvpn 	86900 	VERIFY X509NAME OK: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-2776-4a, emailAddress=support@expressvpn.com
                          2021-05-27 08:42:43.499492+02:00 	openvpn 	86900 	VERIFY EKU OK
                          2021-05-27 08:42:43.499443+02:00 	openvpn 	86900 	++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
                          2021-05-27 08:42:43.499382+02:00 	openvpn 	86900 	Validating certificate extended key usage
                          2021-05-27 08:42:43.499330+02:00 	openvpn 	86900 	VERIFY KU OK
                          2021-05-27 08:42:43.498816+02:00 	openvpn 	86900 	VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
                          2021-05-27 08:42:43.498660+02:00 	openvpn 	86900 	VERIFY WARNING: depth=1, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
                          2021-05-27 08:42:43.498568+02:00 	openvpn 	86900 	VERIFY WARNING: depth=0, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-2776-4a, emailAddress=support@expressvpn.com
                          2021-05-27 08:42:43.472192+02:00 	openvpn 	86900 	TLS: Initial packet from [AF_INET]45.91.22.2:1195, sid=741e1863 61e2292e
                          2021-05-27 08:42:43.448232+02:00 	openvpn 	86900 	UDPv4 link remote: [AF_INET]45.91.22.2:1195
                          2021-05-27 08:42:43.448220+02:00 	openvpn 	86900 	UDPv4 link local (bound): [AF_INET]192.168.10.3:0
                          2021-05-27 08:42:43.448194+02:00 	openvpn 	86900 	Socket Buffers: R=[42080->524288] S=[57344->524288]
                          2021-05-27 08:42:43.448130+02:00 	openvpn 	86900 	TCP/UDP: Preserving recently used remote address: [AF_INET]45.91.22.2:1195
                          2021-05-27 08:42:43.447802+02:00 	openvpn 	86900 	Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
                          2021-05-27 08:42:43.447712+02:00 	openvpn 	86900 	Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
                          2021-05-27 08:42:43.447417+02:00 	openvpn 	86900 	WARNING: experimental option --capath /var/etc/openvpn/client2/ca
                          2021-05-27 08:42:43.446230+02:00 	openvpn 	86900 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                          2021-05-27 08:42:43.446125+02:00 	openvpn 	86900 	MANAGEMENT: unix domain socket listening on /var/etc/openvpn/client2/sock
                          2021-05-27 08:42:43.445134+02:00 	openvpn 	86645 	library versions: OpenSSL 1.1.1k-freebsd 25 Mar 2021, LZO 2.10
                          2021-05-27 08:42:43.445121+02:00 	openvpn 	86645 	OpenVPN 2.5.1 amd64-portbld-freebsd12.2 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Apr 5 2021
                          2021-05-27 08:42:43.445097+02:00 	openvpn 	86645 	WARNING: file '/var/etc/openvpn/client2/up' is group or others accessible
                          

                          The OpenVPN client connected.
                          I did not test routing over it.

                          a01ba75d-98cc-4fa6-8038-3d3a77b3653a-image.png

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          J 1 Reply Last reply Reply Quote 0
                          • J
                            Jegavelan @Gertjan
                            last edited by

                            @gertjan I removed all the existing certs and configuration and re-created everything like what you have now.

                            I got rid of the auth_failed error now , but VPN is not getting connected. Attached other configuration and logs.

                            May 27 10:16:53	openvpn	98617	MANAGEMENT: Client disconnected
                            May 27 10:16:53	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:16:53	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:16:53	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:16:54	openvpn	98617	event_wait returned 0
                            May 27 10:16:54	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:16:54	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:16:54	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:16:54	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:16:54	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:16:55	openvpn	98617	event_wait returned 0
                            May 27 10:16:55	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:16:55	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:16:55	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:16:55	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:16:55	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:16:57	openvpn	98617	event_wait returned 0
                            May 27 10:16:57	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:16:57	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:16:57	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:16:57	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:16:57	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:16:58	openvpn	98617	event_wait returned 0
                            May 27 10:16:58	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:16:58	openvpn	98617	FRAG_OUT len=17 type=0 seq_id=0 frag_id=0 frag_size=0 flags=0x00000000
                            May 27 10:16:58	openvpn	98617	TLS Warning: no data channel send key available: [key#0 state=S_PRE_START id=0 sid=00000000 00000000] [key#1 state=S_UNDEF id=0 sid=00000000 00000000] [key#2 state=S_UNDEF id=0 sid=00000000 00000000]
                            May 27 10:16:58	openvpn	98617	SENT PING
                            May 27 10:16:58	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:16:58	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:16:58	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:16:58	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:16:59	openvpn	98617	event_wait returned 0
                            May 27 10:16:59	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:16:59	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:16:59	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:16:59	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:16:59	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:17:00	newsyslog	40369	logfile turned over due to size>500K
                            May 27 10:17:00	newsyslog	40369	logfile turned over due to size>500K
                            May 27 10:17:00	openvpn	98617	event_wait returned 0
                            May 27 10:17:00	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:00	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:00	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:00	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:00	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:17:01	openvpn	98617	event_wait returned 0
                            May 27 10:17:01	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:01	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:01	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:01	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:01	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/195856]
                            May 27 10:17:03	openvpn	98617	event_wait returned 0
                            May 27 10:17:03	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:03	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:03	openvpn	98617	RANDOM USEC=201521
                            May 27 10:17:03	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:03	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:03	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:04	openvpn	98617	event_wait returned 0
                            May 27 10:17:04	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:04	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:04	openvpn	98617	TLS: tls_multi_process: i=0 state=S_PRE_START, mysid=6a6153d2 e65257b6, stored-sid=00000000 00000000, stored-ip=[AF_INET]191.101.42.152:1195
                            May 27 10:17:04	openvpn	98617	TLS: tls_process: chg=0 ks=S_PRE_START lame=S_UNDEF to_link->len=0 wakeup=604800
                            May 27 10:17:04	openvpn	98617	ACK reliable_can_send active=1 current=1 : [1] 0
                            May 27 10:17:04	openvpn	98617	ACK reliable_send ID 0 (size=4 to=32)
                            May 27 10:17:04	openvpn	98617	write_control_auth(): P_CONTROL_HARD_RESET_CLIENT_V2
                            May 27 10:17:04	openvpn	98617	ENCRYPT HMAC: 92bb1f18 cf2c8366 d7e8d2bf 9b56e3f7 02762ece ea7f8f39 2ff5e4b2 c507750b
                            May 27 10:17:04	openvpn	98617	ENCRYPT TO: 92bb1f18 cf2c8366 d7e8d2bf 9b56e3f7 02762ece ea7f8f39 2ff5e4b2 c507750[more...]
                            May 27 10:17:04	openvpn	98617	Reliable -> TCP/UDP
                            May 27 10:17:04	openvpn	98617	ACK reliable_send_timeout 32 [1] 0
                            May 27 10:17:04	openvpn	98617	TLS: tls_process: timeout set to 29
                            May 27 10:17:04	openvpn	98617	TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=060639a3 0d491fb6, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
                            May 27 10:17:04	openvpn	98617	TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
                            May 27 10:17:04	openvpn	98617	UDPv4 WRITE [54] to [AF_INET]191.101.42.152:1195: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 sid=6a6153d2 e65257b6 tls_hmac=92bb1f18 cf2c8366 d7e8d2bf 9b56e3f7 02762ece ea7f8f39 2ff5e4b2 c507750b pid=[ #5 / time = (1622128593) 2021-05-27 10:16:33 ] [ ] pid=0 DATA
                            May 27 10:17:04	openvpn	98617	UDPv4 write returned 54
                            May 27 10:17:04	openvpn	98617	TLS: tls_multi_process: i=0 state=S_PRE_START, mysid=6a6153d2 e65257b6, stored-sid=00000000 00000000, stored-ip=[AF_INET]191.101.42.152:1195
                            May 27 10:17:04	openvpn	98617	TLS: tls_process: chg=0 ks=S_PRE_START lame=S_UNDEF to_link->len=0 wakeup=604800
                            May 27 10:17:04	openvpn	98617	ACK reliable_can_send active=1 current=0 : [1] 0
                            May 27 10:17:04	openvpn	98617	ACK reliable_send_timeout 32 [1] 0
                            May 27 10:17:04	openvpn	98617	TLS: tls_process: timeout set to 29
                            May 27 10:17:04	openvpn	98617	TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=060639a3 0d491fb6, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
                            May 27 10:17:04	openvpn	98617	TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
                            May 27 10:17:04	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:04	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:04	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:05	openvpn	98617	event_wait returned 0
                            May 27 10:17:05	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:05	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:05	openvpn	98617	TLS: tls_multi_process: i=0 state=S_PRE_START, mysid=6a6153d2 e65257b6, stored-sid=00000000 00000000, stored-ip=[AF_INET]191.101.42.152:1195
                            May 27 10:17:05	openvpn	98617	TLS: tls_process: chg=0 ks=S_PRE_START lame=S_UNDEF to_link->len=0 wakeup=604800
                            May 27 10:17:05	openvpn	98617	ACK reliable_can_send active=1 current=0 : [1] 0
                            May 27 10:17:05	openvpn	98617	ACK reliable_send_timeout 31 [1] 0
                            May 27 10:17:05	openvpn	98617	TLS: tls_process: timeout set to 28
                            May 27 10:17:05	openvpn	98617	TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=060639a3 0d491fb6, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
                            May 27 10:17:05	openvpn	98617	TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
                            May 27 10:17:05	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:05	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:05	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:06	openvpn	98617	event_wait returned 0
                            May 27 10:17:06	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:06	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:06	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:06	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:06	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:07	openvpn	98617	event_wait returned 0
                            May 27 10:17:07	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:07	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:07	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:07	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:07	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:09	openvpn	98617	event_wait returned 0
                            May 27 10:17:09	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:09	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:09	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:09	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:09	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:10	openvpn	98617	event_wait returned 0
                            May 27 10:17:10	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:10	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:10	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:10	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:10	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:11	openvpn	98617	event_wait returned 0
                            May 27 10:17:11	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:11	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:11	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:11	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:11	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:12	openvpn	98617	event_wait returned 0
                            May 27 10:17:12	openvpn	98617	I/O WAIT status=0x0020
                            May 27 10:17:12	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:12	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:12	openvpn	98617	PO_CTL rwflags=0x0001 ev=3 arg=0x002b5c18
                            May 27 10:17:12	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/201521]
                            May 27 10:17:13	openvpn	98617	PO_WAIT[1,0] fd=3 rev=0x00000001 rwflags=0x0001 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	event_wait returned 1
                            May 27 10:17:13	openvpn	98617	I/O WAIT status=0x0040
                            May 27 10:17:13	openvpn	98617	MANAGEMENT: Client connected from /var/etc/openvpn/client1/sock
                            May 27 10:17:13	openvpn	98617	TIMER: coarse timer wakeup 1 seconds
                            May 27 10:17:13	openvpn	98617	RANDOM USEC=192571
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0002 ev=5 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/192571]
                            May 27 10:17:13	openvpn	98617	PO_WAIT[1,0] fd=5 rev=0x00000004 rwflags=0x0002 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	event_wait returned 1
                            May 27 10:17:13	openvpn	98617	I/O WAIT status=0x0080
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0001 ev=5 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/192571]
                            May 27 10:17:13	openvpn	98617	PO_WAIT[1,0] fd=5 rev=0x00000001 rwflags=0x0001 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	event_wait returned 1
                            May 27 10:17:13	openvpn	98617	I/O WAIT status=0x0040
                            May 27 10:17:13	openvpn	98617	MANAGEMENT: CMD 'state 1'
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0002 ev=5 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/192571]
                            May 27 10:17:13	openvpn	98617	PO_WAIT[1,0] fd=5 rev=0x00000004 rwflags=0x0002 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	event_wait returned 1
                            May 27 10:17:13	openvpn	98617	I/O WAIT status=0x0080
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0001 ev=6 arg=0x002b6928
                            May 27 10:17:13	openvpn	98617	PO_CTL rwflags=0x0001 ev=5 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	I/O WAIT T?|T?|SR|Sw [1/192571]
                            May 27 10:17:13	openvpn	98617	PO_WAIT[1,0] fd=5 rev=0x00000011 rwflags=0x0001 arg=0x002b5c18
                            May 27 10:17:13	openvpn	98617	event_wait returned 1
                            May 27 10:17:13	openvpn	98617	I/O WAIT status=0x0040
                            May 27 10:17:13	openvpn	98617	MANAGEMENT: Client disconnected
                            

                            NAT01.jpg NAT.jpg Hostcollection.jpg Firewall Rules.jpg Firewall Rules 01.jpg DNS.jpg

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @Jegavelan
                              last edited by

                              @jegavelan

                              Your Manual NAT entries, and the second LAN firewall rule look fine to me.

                              These :

                              7e34099a-64a9-4447-9e92-b2d0573a19af-image.png

                              are Floating rules ?
                              if so, then that's not looking fine at all ..... Why did you create these rules ??

                              Same thing for DNS settings : not needed at all.

                              Make first a minimal Client VPN setup with https://www.youtube.com/watch?v=lp3mtR4j3Lw

                              Btw : when the VPN client is connected = working, drop the verbosity of the VPN log - reset it to 3. It's not needed to see enties for every byte that goes out. It tends to hide crusial information.

                              @jegavelan said in Express VPN Received control message: AUTH_FAILED:

                              re-created everything like what you have now

                              I used the info from my vpn's account page.
                              And this one : https://www.expressvpn.com/fr/support/vpn-setup/pfsense-with-expressvpn-openvpn/

                              Keep in mind that OpenVPN had a huge update a couple of month ago : the version used back then was 2.4.7 ( ? ) and now pfSens is using the version 2.5.1 - the future, upcoming version will be 2.5.2. This means that this ExprssVPN / pfSense help page should be double checked with the new and changed OpenVPN parameters. It's not a click here click there and go solution.
                              Also : I don't know what version of OpenVPN ExpessV
                              N is using on their side. I do know that my setup worked last time I tested it, using pgSense 2.5.1 and OpenVPN .

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              4 1 Reply Last reply Reply Quote 0
                              • 4
                                4o4rh @Gertjan
                                last edited by

                                @gertjan did you ever solve this?

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @4o4rh
                                  last edited by

                                  @gwaitsi said in Express VPN Received control message: AUTH_FAILED:

                                  @gertjan did you ever solve this?

                                  Never had any issues while using 'pfSense' and 'ExpressVPN'. My connection is not actually used right now, but it's up for years now. Some maintenance is needed ones in a while, as Express can change things on their side, and pfSense also changes the OpenVPN version regularly. It's an on going read-learn-apply cycle.

                                  9ca73897-dd88-486d-bb79-aaba3a519cfe-image.png

                                  Read again, I was trying to answer questions. Not asking them.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  4 1 Reply Last reply Reply Quote 0
                                  • 4
                                    4o4rh @Gertjan
                                    last edited by

                                    @gertjan yes it works, but i also have these messages in my logs for both expressvpn and protonvpn. i.e. certificate verify warning

                                    ay 26 15:00:23	openvpn	75963	VERIFY WARNING: depth=0, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-1417-1a, emailAddress=support@expressvpn.com
                                    May 26 15:00:23	openvpn	75963	VERIFY WARNING: depth=1, unable to get certificate CRL: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
                                    May 26 15:00:23	openvpn	75963	VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
                                    M
                                    
                                    GertjanG 1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @4o4rh
                                      last edited by

                                      @gwaitsi said in Express VPN Received control message: AUTH_FAILED:

                                      unable to get certificate CR

                                      CRL missing, or not accessible, isn't a big deal in this case.
                                      See for example unable to get certificate crl

                                      If something happens to the certificate emitted by expressvpn, they would remove it message or warning, and force you to update your connection settings.
                                      There is no such thing as : expressvpn let you use their generated certs, but starts to list them on a revocation list. That not needed in this usage case.
                                      I've these same two warnings.

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.