Would be really thankful if anyone could help. My OpenVPN version is 2.2.1-8 according to

apt-cache show openvpn

According to numerous sources you have to use -ncp-disable in order to turn off encryption on your server side. Now I have tried all of the following (separately and one by one of course):

ncp disable
disable ncp
cipher none

but none of them works after I restart my openvpn. It always says, "starting VPN failed". Now what are the correct lines and where do I have to put them in my vpn.conf in order for them to work? Perhaps it should be something totally different in my openvpn version? I would be really grateful for any suggestions as I am totally clueless now.

P.S. It's working perfectly fine without any of these lines at all.

P.S.S. Here are my config files as asked by Nikita:

port 1194
proto udp
dev tun0

ca /etc/openvpn/easy-rsa-first/keys/ca.crt
cert /etc/openvpn/easy-rsa-first/keys/name.com.crt
key /etc/openvpn/easy-rsa-first/keys/name.com.key
dh /etc/openvpn/easy-rsa-first/keys/dh2048.pem 

ifconfig-pool-persist openvpn.dhcp
push "redirect-gateway"
push "dhcp-option DNS"
push "dhcp-option DNS"

push "route"

keepalive 10 120

user myvpn
group myvpn

status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log
verb 7
mute 20

#;push "route"
#;push "route"

#;client-config-dir ccd
#;max-clients 3

dev tun0
proto udp

remote 1194

resolv-retry infinite
ca "ca.crt"
cert "Certificate.crt"
key "Key.key"

ns-cert-type server
verb 7
mute 20
  • Why you think this is a cipher issue? Post your configs for both server and client for us to check for obvious mistakes. Of course, you must scramble sensetive information. – Nikita Kipriyanov Jan 16 at 9:53
  • Because it's working fine without "-ncp-disable" lines as per my P.S. above. But that is only my guess of course. My configs are posted. – Dennis Jan 16 at 10:26
  • That was very important information that it worked! BTW, why you ever need this? Probably there are more secure ways to do what you intend? – Nikita Kipriyanov Jan 16 at 14:24

Your OpenVPN is quite old. And ncp-disable does not disable encryption. Official OpenVPN manual says:

    Disable "negotiable crypto parameters".
    This completely disables cipher negotiation. 

OpenVPN introduced a cipher negotiation in version 2.4, and this directive is meant as a debug aid to disable negotiation and to work like previous versions, which just used whatever is configured with cipher option in them, defaulting to BF-CBC if that option is missing. Versions 2.3 and below don't support NCP and therefore don't have this directive and its use should result in an error. Also, this directive is deprecated in OpenVPN 2.5 and 2.6 and will be removed in, I think, in 2.7.

There is also a part in manual just near that, which directly says how to disable encryption:

--cipher alg
    Encrypt data channel packets with cipher algorithm alg.

    The default is BF-CBC, an abbreviation for Blowfish in Cipher Block 
    Chaining mode. When cipher negotiation (NCP) is allowed, OpenVPN 2.4
    and newer on both client and server side will automatically upgrade to 
    AES-256-GCM. See --ncp-ciphers and --ncp-disable for more details on NCP.

    Using BF-CBC is no longer recommended, because of its 64-bit block size. 
    This small block size allows attacks based on collisions, as demonstrated
    by SWEET32. See https://community.openvpn.net/openvpn/wiki/SWEET32 for 
    details. Due to this, support for BF-CBC, DES, CAST5, IDEA and RC2 ciphers 
    will be removed in OpenVPN 2.6.

    To see other ciphers that are available with OpenVPN, use the 
    --show-ciphers option.

    Set alg=none to disable encryption.

You write in the config file:

cipher none

to disable encryption. You still might need to use this ncp-disable option on systems where OpenVPN 2.4 to 2.6 is installed and intended to connect to this server. I believe it isn't possbile to set ncp-ciphers none, but I didn't checked it.

Also note. Trying random strings as options never helps, and can even cause harm if you accidentally hit something meaningful. Manual lists all available directives, and also there is specified that you write them with with two dashes (like --ncp-disable) on the command line, but without leading dashes (like ncp-disable) in the config file.

I strongly suggest to always consult with official manuals first, and only if it isn't clear enough to look for additional third-party information. And always check that information agianst official manual which is available on Unix-like systems as man openvpn and corresponds to the used version.

  • Thank you for trying but it doesn't work. If you take a careful look at my question there is this "cipher none" option mentioned. I have tried it before and it fails to start my vpn when I set it. – Dennis Jan 16 at 14:34
  • I also tried Set alg=none and alg=none yesterday as I read through manuals too. Unfortunately, it also failed to start my vpn when these were set. It simply didn't run at all. – Dennis Jan 16 at 14:50
  • Then you must include logs, not just cryptic "vpn start failed". Also, verb 7 is way more verbose than we need, verb 4 here must be sufficient. – Nikita Kipriyanov Jan 16 at 14:53

Gee.. boy my stupid. There was nothing to it when you do it the other way around. I simply added another cipher instead of turning encryption off. It looks like it's impossible to turn it off at all in these old versions. I couldn't find it how anyway..

So what did the trick for me was adding those two in my openvpn.vpn config file server side like this:

cipher AES-256-CBC
cipher CBC

The front door was closed but the back door was opened so I entered there and it worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.