Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My openvpn client log file-

The interesting bit:

Tue Oct 26 12:32:49 2010 TLS Error: cannot locate HMAC in incoming packet from 67.228.223.12:3389
Tue Oct 26 12:32:49 2010 Fatal TLS error (check_tls_errors_co), restarting
Tue Oct 26 12:32:49 2010 TCP/UDP: Closing socket

The rest of the log just in case:

Tue Oct 26 12:32:35 2010 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Tue Oct 26 12:32:48 2010 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 26 12:32:48 2010 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Oct 26 12:32:48 2010 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 26 12:32:48 2010 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 26 12:32:48 2010 LZO compression initialized
Tue Oct 26 12:32:48 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Oct 26 12:32:48 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 26 12:32:48 2010 Local Options hash (VER=V4): 'ee93268d'
Tue Oct 26 12:32:48 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Oct 26 12:32:48 2010 Attempting to establish TCP connection with 67.228.223.12:3389
Tue Oct 26 12:32:48 2010 TCP connection established with 67.228.223.12:3389
Tue Oct 26 12:32:48 2010 TCPv4_CLIENT link local: [undef]
Tue Oct 26 12:32:48 2010 TCPv4_CLIENT link remote: 67.228.223.12:3389
Tue Oct 26 12:32:49 2010 TLS: Initial packet from 67.228.223.12:3389, sid=bd5f79fe 8475497f
Tue Oct 26 12:32:49 2010 TLS Error: cannot locate HMAC in incoming packet from 67.228.223.12:3389
Tue Oct 26 12:32:49 2010 Fatal TLS error (check_tls_errors_co), restarting
Tue Oct 26 12:32:49 2010 TCP/UDP: Closing socket
Tue Oct 26 12:32:49 2010 SIGUSR1[soft,tls-error] received, process restarting
Tue Oct 26 12:32:49 2010 Restart pause, 5 second(s)
Tue Oct 26 12:32:54 2010 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 26 12:32:54 2010 Re-using SSL/TLS context
Tue Oct 26 12:32:54 2010 LZO compression initialized
Tue Oct 26 12:32:54 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Oct 26 12:32:54 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 26 12:32:54 2010 Local Options hash (VER=V4): 'ee93268d'
Tue Oct 26 12:32:54 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Oct 26 12:32:54 2010 Attempting to establish TCP connection with 67.228.223.12:3389
Tue Oct 26 12:32:54 2010 TCP connection established with 67.228.223.12:3389
Tue Oct 26 12:32:54 2010 TCPv4_CLIENT link local: [undef]
Tue Oct 26 12:32:54 2010 TCPv4_CLIENT link remote: 67.228.223.12:3389
Tue Oct 26 12:32:54 2010 TLS: Initial packet from 67.228.223.12:3389, sid=1643b931 ce240d5f
Tue Oct 26 12:32:54 2010 TLS Error: cannot locate HMAC in incoming packet from 67.228.223.12:3389
Tue Oct 26 12:32:54 2010 Fatal TLS error (check_tls_errors_co), restarting
Tue Oct 26 12:32:54 2010 TCP/UDP: Closing socket
Tue Oct 26 12:32:54 2010 SIGUSR1[soft,tls-error] received, process restarting
Tue Oct 26 12:32:54 2010 Restart pause, 5 second(s)
Tue Oct 26 12:32:59 2010 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 26 12:32:59 2010 Re-using SSL/TLS context
Tue Oct 26 12:32:59 2010 LZO compression initialized
Tue Oct 26 12:32:59 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Oct 26 12:32:59 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 26 12:32:59 2010 Local Options hash (VER=V4): 'ee93268d'
Tue Oct 26 12:32:59 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Oct 26 12:32:59 2010 Attempting to establish TCP connection with 67.228.223.12:3389
Tue Oct 26 12:33:00 2010 TCP connection established with 67.228.223.12:3389
Tue Oct 26 12:33:00 2010 TCPv4_CLIENT link local: [undef]
Tue Oct 26 12:33:00 2010 TCPv4_CLIENT link remote: 67.228.223.12:3389
Tue Oct 26 12:33:00 2010 TLS: Initial packet from 67.228.223.12:3389, sid=cd439fb2 d625ca0d
Tue Oct 26 12:33:00 2010 TLS Error: cannot locate HMAC in incoming packet from 67.228.223.12:3389
Tue Oct 26 12:33:00 2010 Fatal TLS error (check_tls_errors_co), restarting
Tue Oct 26 12:33:00 2010 TCP/UDP: Closing socket
Tue Oct 26 12:33:00 2010 SIGUSR1[soft,tls-error] received, process restarting
Tue Oct 26 12:33:00 2010 Restart pause, 5 second(s)
Tue Oct 26 12:33:05 2010 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 26 12:33:05 2010 Re-using SSL/TLS context
Tue Oct 26 12:33:05 2010 LZO compression initialized
Tue Oct 26 12:33:05 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Oct 26 12:33:05 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 26 12:33:05 2010 Local Options hash (VER=V4): 'ee93268d'
Tue Oct 26 12:33:05 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Oct 26 12:33:05 2010 Attempting to establish TCP connection with 67.228.223.12:3389
Tue Oct 26 12:33:06 2010 TCP connection established with 67.228.223.12:3389
Tue Oct 26 12:33:06 2010 TCPv4_CLIENT link local: [undef]
Tue Oct 26 12:33:06 2010 TCPv4_CLIENT link remote: 67.228.223.12:3389
Tue Oct 26 12:33:06 2010 TLS: Initial packet from 67.228.223.12:3389, sid=28f0cb87 69c90cde
Tue Oct 26 12:33:06 2010 TLS Error: cannot locate HMAC in incoming packet from 67.228.223.12:3389
Tue Oct 26 12:33:06 2010 Fatal TLS error (check_tls_errors_co), restarting
Tue Oct 26 12:33:06 2010 TCP/UDP: Closing socket
Tue Oct 26 12:33:06 2010 SIGUSR1[soft,tls-error] received, process restarting
Tue Oct 26 12:33:06 2010 Restart pause, 5 second(s)
Tue Oct 26 12:33:11 2010 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 26 12:33:11 2010 Re-using SSL/TLS context
Tue Oct 26 12:33:11 2010 LZO compression initialized
Tue Oct 26 12:33:11 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Oct 26 12:33:11 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 26 12:33:11 2010 Local Options hash (VER=V4): 'ee93268d'
Tue Oct 26 12:33:11 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Oct 26 12:33:11 2010 Attempting to establish TCP connection with 67.228.223.12:3389
Tue Oct 26 12:33:11 2010 TCP connection established with 67.228.223.12:3389
Tue Oct 26 12:33:11 2010 TCPv4_CLIENT link local: [undef]
Tue Oct 26 12:33:11 2010 TCPv4_CLIENT link remote: 67.228.223.12:3389
Tue Oct 26 12:33:12 2010 TLS: Initial packet from 67.228.223.12:3389, sid=128becf9 f62adf0c
Tue Oct 26 12:33:12 2010 TLS Error: cannot locate HMAC in incoming packet from 67.228.223.12:3389
Tue Oct 26 12:33:12 2010 Fatal TLS error (check_tls_errors_co), restarting
Tue Oct 26 12:33:12 2010 TCP/UDP: Closing socket
Tue Oct 26 12:33:12 2010 SIGUSR1[soft,tls-error] received, process restarting
Tue Oct 26 12:33:12 2010 Restart pause, 5 second(s)
Tue Oct 26 12:33:17 2010 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 26 12:33:17 2010 Re-using SSL/TLS context
Tue Oct 26 12:33:17 2010 LZO compression initialized
Tue Oct 26 12:33:17 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Oct 26 12:33:17 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 26 12:33:17 2010 Local Options hash (VER=V4): 'ee93268d'
Tue Oct 26 12:33:17 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Oct 26 12:33:17 2010 Attempting to establish TCP connection with 67.228.223.12:3389
Tue Oct 26 12:33:20 2010 TCP/UDP: Closing socket
Tue Oct 26 12:33:20 2010 SIGTERM[hard,init_instance] received, process exiting

Guys I am extremely sorry for not presenting my error Log properly, please forgive me and give me your valuable advice. I am using windows 7 and I am using openvpn mainly to bypass censorship at UAE. I am using only client config file. Ca.crt file is in config folder Thanks and regards Nitin

My error Log with Config1 file

Tue Oct 26 21:24:34 2010 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006
Tue Oct 26 21:24:46 2010 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 26 21:24:46 2010 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file Tue Oct 26 21:24:46 2010 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 26 21:24:46 2010 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 26 21:24:46 2010 LZO compression initialized
Tue Oct 26 21:24:46 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Oct 26 21:24:46 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 26 21:24:46 2010 Local Options hash (VER=V4): 'ee93268d'
Tue Oct 26 21:24:46 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Tue Oct 26 21:24:46 2010 Attempting to establish TCP connection with 67.228.223.12:3389
Tue Oct 26 21:24:47 2010 TCP connection established with 67.228.223.12:3389
Tue Oct 26 21:24:47 2010 TCPv4_CLIENT link local: [undef]
Tue Oct 26 21:24:47 2010 TCPv4_CLIENT link remote: 67.228.223.12:3389
Tue Oct 26 21:24:47 2010 TLS: Initial packet from 67.228.223.12:3389, sid=4244e662 e5a0572a
Tue Oct 26 21:24:47 2010 TLS Error: cannot locate HMAC in incoming packet from 67.228.223.12:3389
Tue Oct 26 21:24:47 2010 Fatal TLS error (check_tls_errors_co), restarting
Tue Oct 26 21:24:47 2010 TCP/UDP: Closing socket
Tue Oct 26 21:24:47 2010 SIGUSR1[soft,tls-error] received, process restarting

client config file:

client
dev tun
proto tcp
remote openvpn1.flashvpn.com 3389
float
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
mute 20
auth-user-pass
route-method exe
route-delay 2
share|improve this question

closed as off-topic by Magellan, Andrew Schulman, Wesley, Ward, Falcon Momot Nov 22 at 8:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Magellan, Andrew Schulman, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Have you copied ca.crt on your client? –  Sergey Oct 26 '10 at 14:44

3 Answers 3

You need to disable your secret Key , try comment this line :

#tls-auth ta.key 1 # This file is secret
share|improve this answer

I think the important error is TLS Error: cannot locate HMAC in incoming packet.

To quote the comment from the sample client.conf, If a tls-auth key is used on the server then every client must also have the key.

I set mine up like this:

tls-auth /etc/openvpn/keys/ta.key 1
share|improve this answer

My problem was here, did not match "auth SHA" server and client:

client

...more
tls-client
tls-auth /storage/emulated/0/OpenVPNkey/ta.key 1
cipher AES-256-CBC
auth SHA1 

server

...more
auth SHA512
share|improve this answer