11

Both in server and client config I have set:

cipher none
auth none

Following this advice I am also using UDP port 1195.

When I launch server and client I get following warnings:

Tue Dec  4 12:58:25 2018 ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!
Tue Dec  4 12:58:25 2018 ******* WARNING *******: '--auth none' was specified. This means no authentication will be performed on received packets, meaning you CANNOT trust that the data received by the remote side have NOT been manipulated. PLEASE DO RECONSIDER THIS SETTING!

...which is good, but still openvpn is using encryption. I know this, because:

1) I get following message on server side when client connects:

Tue Dec  4 12:59:59 2018 client_abc/10.20.73.2:36752 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Dec  4 12:59:59 2018 client_abc/10.20.73.2:36752 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

2) I get huuuge CPU load on both sides

3) I see in Wireshark that data is encrypted

What else is required to disable encryption?

  • 1
    Could you please share a context of usage? As you are trying to disable any auth and encryption the usage of openvpn may be questionable... There may be even better approach to just encapsulate the traffic (e.g. ipip, gre,...) – Kamil J Dec 4 '18 at 12:25
  • 6
    I am just experimenting, trying to find out what is the encryption impact on CPU load – user2449761 Dec 4 '18 at 12:46
28

It looks like you have Negotiable Crypto Parameters (NCP) enabled. You should specify

ncp-disable

Disable “negotiable crypto parameters”. This completely disables cipher negotiation.

When two OpenVPN instances have NCP enabled (default for recent versions) they will negotiate which cipher to use from a set of ciphers defined by ncp-ciphers. The default for that is 'AES-256-GCM:AES-128-GCM' which explains why you see AES-256-GCM on your connection.

12

Assuming you are running openvpn 2.4 I belive you also need to set

ncp-disable

https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.