Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to connect a laptop running Linux Mint to a FreeBSD server running OpenVPN with no luck. I keep seeing TLS errors like this in the server log:

Tue Sep 17 23:14:51 2013 us=127496 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Sep 17 23:14:51 2013 us=127570 TLS Error: incoming packet authentication failed from [AF_INET] \\my IP number\\

I have tried using TCP instead of UDP, authenticating by password, and various other options, all to no avail. Here is the server config:

daemon
port 1194
proto udp
dev tun
ca      /usr/local/etc/openvpn/keys/ca.crt
cert    /usr/local/etc/openvpn/keys/server.crt
key     /usr/local/etc/openvpn/keys/server.key
dh      /usr/local/etc/openvpn/keys/dh2048.pem
server 192.168.100.0 255.255.255.0
tls-server
tls-auth /usr/local/etc/openvpn/keys/ta.key 0 # This file is secret
keepalive 10 120
duplicate-cn
user nobody
group nobody
persist-key
persist-tun
status                  /var/openvpn-status.log
log-append              /var/log/openvpn.log
verb 5

I generated the ca.crt and ca.key files on the server and copied them to the client along with ta.key, after which I created the necessary client certificates.

I am using Gnome Network Manager to configure the OpenVPN client. Not sure where it is writing its settings.

Any thoughts about what might be going wrong here?

TIA

share|improve this question
add comment

1 Answer

Have you transferred the TA.key file to the client? This file is a shared secret. It must be available on the client, and referenced by the configuration.

That feature isn't required though, you could disable it on the server.

share|improve this answer
1  
Specifically, it needs to be configured as tls-auth ta.key 1 (instead of 0) on the client side. Details here –  DerfK Sep 17 '13 at 22:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.