Errors on OpenVPN logs server

Grif49 · Apr 8, 2020, 9:03 AM

Hello,

I have a pfsense 2.4.5 server as a OpenVPN server. All seems to be good because, Windows and Linux clients connects with no issue et no error. But when i go to the OpenVPN logs on pfsense server i have these errors :

Apr 8 10:51:19 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):58039
Apr 8 10:51:19 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:19 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):10538
Apr 8 10:51:19 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:19 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):23125
Apr 8 10:51:20 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:20 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):59269
Apr 8 10:51:20 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:20 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):15063
Apr 8 10:51:20 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:20 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):44190
Apr 8 10:51:20 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:20 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):10862
Apr 8 10:51:21 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:21 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):12606
Apr 8 10:51:21 openvpn 33418 Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 8 10:51:21 openvpn 33418 TLS Error: incoming packet authentication failed from [AF_INET](MY PUBLIC IP):64087

Have you any idea of what these errors means?

Thanks for your responses

jimp · Apr 8, 2020, 2:01 PM

It means what it says, a packet came in and it didn't have the correct authentication information (as in TLS authentication, not username/password).

Could be a variety of reasons for that happening, like a non-OpenVPN client trying to hit that port (port scanners, etc), a misconfigured client, and so on.

If all of your clients are connecting and operating as expected, then you probably do not have anything to worry about.

If the 'client' in this case really is the public IP address of your own router, then check that you don't have anything on the OpenVPN client tab set to connect to the server instance on the same firewall. I've seen a couple people do that over the years not knowing it wasn't necessary.

Grif49 · Apr 8, 2020, 4:19 PM

The last solution resolve my problem.

Thanks a lot !

M0L50N · Nov 29, 2021, 8:10 PM

@jimp Is that possible to run 2 OpenVPN clients from the same public IP to the same server but not the same instance?

Gertjan · Nov 30, 2021, 2:56 PM

@m0l50n
You can run several OpenVPN instances all using the same (WAN) interface.
For example : all on the same interface :
One using UDP on port 1194 (default).
Another one using port 1194 - using TCP !
And another one using port 1111 using UDP,
etc.

M0L50N · Dec 1, 2021, 1:31 PM

@gertjan Ok thanks.

But just to be sure I well understand. That's normal I got communications problems if, always from my home, I'm connecting to our office openVPN server with

1 open vpn client from my computer on UDP 1195
1 open vpn client from my iphone on UDP 1200

I mean, 2 clients from the same location connecting to the same OpenVPN server (same WAN IP) on same protocol (UDP) can be problematic?!?!?

THanks

Gertjan · Dec 1, 2021, 1:31 PM

@m0l50n said in Errors on OpenVPN logs server:

I mean, 2 clients from the same location connecting to the same OpenVPN server (same WAN IP) on same protocol (UDP) can be problematic?!?!?

Not problematic.
The ports are different.
You have a OpenVPN set up to listen on port 1200
and you have another OpenVPN server set up to listen on port 1195.
Two complete separate instances, using their own settings.

Example : many web server have two processes running :
One web server, listing on port 80, doing the ancient "http" stuff.
Another web server using other settings (with some TLS settings added) listens on port 443 and handles the "https" access.
Both web server process serve the same data, doing the same things. It's just the "communication channel" that chances.