Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to connect a laptop running Linux Mint to a FreeBSD server running OpenVPN with no luck. I keep seeing TLS errors like this in the server log:

Tue Sep 17 23:14:51 2013 us=127496 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Sep 17 23:14:51 2013 us=127570 TLS Error: incoming packet authentication failed from [AF_INET] \\my IP number\\

I have tried using TCP instead of UDP, authenticating by password, and various other options, all to no avail. Here is the server config:

port 1194
proto udp
dev tun
ca      /usr/local/etc/openvpn/keys/ca.crt
cert    /usr/local/etc/openvpn/keys/server.crt
key     /usr/local/etc/openvpn/keys/server.key
dh      /usr/local/etc/openvpn/keys/dh2048.pem
tls-auth /usr/local/etc/openvpn/keys/ta.key 0 # This file is secret
keepalive 10 120
user nobody
group nobody
status                  /var/openvpn-status.log
log-append              /var/log/openvpn.log
verb 5

I generated the ca.crt and ca.key files on the server and copied them to the client along with ta.key, after which I created the necessary client certificates.

I am using Gnome Network Manager to configure the OpenVPN client. Not sure where it is writing its settings.

Any thoughts about what might be going wrong here?


share|improve this question

Have you transferred the TA.key file to the client? This file is a shared secret. It must be available on the client, and referenced by the configuration.

That feature isn't required though, you could disable it on the server.

share|improve this answer
Specifically, it needs to be configured as tls-auth ta.key 1 (instead of 0) on the client side. Details here – DerfK Sep 17 '13 at 22:04
If you want to use the unified .ovpn file format with the <tls-auth> element, use the option key-direction 1. – neuhaus Mar 23 at 13:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.