OpenVPN and PIA Errors | Reconnecting (Auth Failure | Authenticating | Pulling configuration from server

8ayM · Mar 18, 2024, 4:02 AM

I had a dedicated VM that would route over the PIA connection via OpenVPN. Not sure when it stopped, but trying to get it back up. Shut it down a few moths ago when Broadcom made the announcement to make change to ESXi, to contemplate what I'd like to move to.

I've tried following
Lawrence Systems "How To Setup pfsense OpenVPN Policy Routing With Kill Switch Using A Privacy VPN"
as well as
Sheridan Computers "Connect pfSense to VPN Provider (OpenVPN Client) - Full Setup"

Both are a bit dated, but look to be listing all the option while making the configuration at this time.

My big confusion is this had worked, but now OpenVPN gives the following errors:

System / Certificate / Authorities
The following was created using the us_new_york.ovpn file from PIA can be found here

OpenVPN Client Config:

Account is still in good standing as well

I'm hoping I've just been looking at this long enough I've gotten tunnel vision. Any thoughts would be appreciated.

NightlyShark · Mar 18, 2024, 8:41 AM

@8ayM The "Hardware Crypto" list doesn't contain entries that you can necessarily use, AES-NI is used automagically anyway, set it to "No Hardware Crypto".

8ayM · Mar 18, 2024, 10:05 PM

@NightlyShark said in OpenVPN and PIA Errors | Reconnecting (Auth Failure | Authenticating | Pulling configuration from server:

@8ayM The "Hardware Crypto" list doesn't contain entries that you can necessarily use, AES-NI is used automagically anyway, set it to "No Hardware Crypto".

I set the "No Hardware Crypto" as you sugested and now I'm getting a different error in Status -> OPENVPN -> Client

NightlyShark · Mar 18, 2024, 10:24 PM

@8ayM There is another point in system settings where you set hardware encryption (System->Advanced?) see that it is set to AES-NI

NightlyShark · Mar 18, 2024, 10:25 PM

@8ayM Also, TLS error, maybe you got an older certificate or did not input it correctly?

NightlyShark · Mar 19, 2024, 5:17 AM

@8ayM Also,
Try that

8ayM · Mar 19, 2024, 5:21 AM

@NightlyShark

I'd already tried the Strong config thinking maybe the 2nd time was the charm, but I was in the same boat. So I already had that configured, based on the link you referenced from the PIA site

There is another point in system settings where you set hardware encryption (System->Advanced?) see that it is set to AES-NI

Set to disabled

Also, TLS error, maybe you got an older certificate or did not input it correctly?

This I just open the NYC strong config in https://www.privateinternetaccess.com/openvpn/openvpn-strong.zip

Here i just copy the portion below into the CA of pfSense<ca> cert

Pasted here

NightlyShark · Mar 19, 2024, 8:08 AM

@8ayM
No, set to AES-NI

NightlyShark · Mar 19, 2024, 8:18 AM

@8ayM
And CPU in Hypervisor set to host mode (no emulation).
And, if you have a recent Intel CPU and PfSense Plus, instead of AES-NI, select Quick Assist

8ayM · Mar 19, 2024, 11:48 AM

@NightlyShark
Set

No hypervisor, this is running on bare metal
No PfSense Plus at this time, but the Intel(R) Atom(TM) CPU C3758 does support QuickAssist

Still have Status -> Open VPN flipping through the status's listed above.

NightlyShark · Mar 19, 2024, 4:05 PM

@8ayM Does it support AES-NI?

8ayM · Mar 19, 2024, 4:05 PM

@NightlyShark said in OpenVPN and PIA Errors | Reconnecting (Auth Failure | Authenticating | Pulling configuration from server:

@8ayM Does it support AES-NI?

Yes

https://www.intel.com/content/www/us/en/products/sku/97926/intel-atom-processor-c3758-16m-cache-up-to-2-20-ghz/specifications.html