Docker-openvpn: Client authentication fails: TLS Error: incoming packet authentication failed from [AF_INET]xx.yy.zz.aa:55501

[jsolla]

I have setup a digitalocean droplet just to check this container, after following all the installation steps as root, creating a user and trying to connect I got this:

root@ubuntu-512MB-VPN:~# docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --privileged -e DEBUG=1 kylemanna/openvpn
+ set -e
+ cd /etc/openvpn
+ USER_ARGS=("${@}")
+ ARGS=()
+ addArg --config /etc/openvpn/openvpn.conf
+ local arg=--config
+ '[' 2 -ge 1 ']'
+ local val=/etc/openvpn/openvpn.conf
+ hasArg --config
+ local element
+ return 1
+ ARGS+=("${arg}")
+ '[' 2 -ge 1 ']'
+ ARGS+=("${val}")
+ source /etc/openvpn/ovpn_env.sh
++ declare -x OVPN_AUTH=
++ declare -x OVPN_CIPHER=
++ declare -x OVPN_CLIENT_TO_CLIENT=
++ declare -x OVPN_CN=<IP REMOVED>
++ declare -x OVPN_COMP_LZO=0
++ declare -x OVPN_DEFROUTE=1
++ declare -x OVPN_DEVICE=tun
++ declare -x OVPN_DEVICEN=0
++ declare -x OVPN_DISABLE_PUSH_BLOCK_DNS=0
++ declare -x OVPN_DNS=1
++ OVPN_DNS_SERVERS=([0]="8.8.8.8" [1]="8.8.4.4")
++ declare -x OVPN_DNS_SERVERS
++ declare -x OVPN_ENV=/etc/openvpn/ovpn_env.sh
++ OVPN_EXTRA_CLIENT_CONFIG=()
++ declare -x OVPN_EXTRA_CLIENT_CONFIG
++ OVPN_EXTRA_SERVER_CONFIG=()
++ declare -x OVPN_EXTRA_SERVER_CONFIG
++ declare -x OVPN_FRAGMENT=
++ declare -x 'OVPN_KEEPALIVE=10 60'
++ declare -x OVPN_MTU=
++ declare -x OVPN_NAT=0
++ declare -x OVPN_PORT=1194
++ declare -x OVPN_PROTO=udp
++ OVPN_PUSH=()
++ declare -x OVPN_PUSH
++ OVPN_ROUTES=([0]="192.168.254.0/24")
++ declare -x OVPN_ROUTES
++ declare -x OVPN_SERVER=192.168.255.0/24
++ declare -x OVPN_SERVER_URL=udp://<IP REMOVED>
++ declare -x OVPN_TLS_CIPHER=
+ mkdir -p /dev/net
+ '[' '!' -c /dev/net/tun ']'
+ '[' -d /etc/openvpn/ccd ']'
+ addArg --client-config-dir /etc/openvpn/ccd
+ local arg=--client-config-dir
+ '[' 2 -ge 1 ']'
+ local val=/etc/openvpn/ccd
+ hasArg --client-config-dir
+ local element
+ return 1
+ ARGS+=("${arg}")
+ '[' 2 -ge 1 ']'
+ ARGS+=("${val}")
+ '[' -z '' ']'
+ OVPN_NATDEVICE=eth0
+ '[' 1 '!=' 0 ']'
+ setupIptablesAndRouting
+ iptables -t nat -C POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE
iptables: No chain/target/match by that name.
+ iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE
+ for i in '"${OVPN_ROUTES[@]}"'
+ iptables -t nat -C POSTROUTING -s 192.168.254.0/24 -o eth0 -j MASQUERADE
iptables: No chain/target/match by that name.
+ iptables -t nat -A POSTROUTING -s 192.168.254.0/24 -o eth0 -j MASQUERADE
+ '[' /etc/openvpn/pki/crl.pem -nt /etc/openvpn/crl.pem ']'
+ '[' -r /etc/openvpn/crl.pem ']'
+ addArg --crl-verify /etc/openvpn/crl.pem
+ local arg=--crl-verify
+ '[' 2 -ge 1 ']'
+ local val=/etc/openvpn/crl.pem
+ hasArg --crl-verify
+ local element
+ return 1
+ ARGS+=("${arg}")
+ '[' 2 -ge 1 ']'
+ ARGS+=("${val}")
+ ip -6 route show default
+ '[' 0 = 0 ']'
+ echo 'Enabling IPv6 Forwarding'
+ sysctl -w net.ipv6.conf.all.disable_ipv6=0
Enabling IPv6 Forwarding
net.ipv6.conf.all.disable_ipv6 = 0
+ sysctl -w net.ipv6.conf.default.forwarding=1
net.ipv6.conf.default.forwarding = 1
+ sysctl -w net.ipv6.conf.all.forwarding=1
net.ipv6.conf.all.forwarding = 1
+ echo 'Running '\''openvpn --config' /etc/openvpn/openvpn.conf --client-config-dir /etc/openvpn/ccd --crl-verify '/etc/openvpn/crl.pem '\'''
Running 'openvpn --config /etc/openvpn/openvpn.conf --client-config-dir /etc/openvpn/ccd --crl-verify /etc/openvpn/crl.pem '
+ exec openvpn --config /etc/openvpn/openvpn.conf --client-config-dir /etc/openvpn/ccd --crl-verify /etc/openvpn/crl.pem
Tue Dec  5 17:51:49 2017 OpenVPN 2.4.4 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Nov 23 2017
Tue Dec  5 17:51:49 2017 library versions: LibreSSL 2.5.5, LZO 2.10
Tue Dec  5 17:51:49 2017 Diffie-Hellman initialized with 2048 bit key
Tue Dec  5 17:51:49 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec  5 17:51:49 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec  5 17:51:49 2017 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:02
Tue Dec  5 17:51:49 2017 TUN/TAP device tun0 opened
Tue Dec  5 17:51:49 2017 TUN/TAP TX queue length set to 100
Tue Dec  5 17:51:49 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Dec  5 17:51:49 2017 /sbin/ip link set dev tun0 up mtu 1500
Tue Dec  5 17:51:49 2017 /sbin/ip addr add dev tun0 local 192.168.255.1 peer 192.168.255.2
Tue Dec  5 17:51:49 2017 /sbin/ip route add 192.168.254.0/24 via 192.168.255.2
Tue Dec  5 17:51:49 2017 /sbin/ip route add 192.168.255.0/24 via 192.168.255.2
Tue Dec  5 17:51:49 2017 Could not determine IPv4/IPv6 protocol. Using AF_INET
Tue Dec  5 17:51:49 2017 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Dec  5 17:51:49 2017 UDPv4 link local (bound): [AF_INET][undef]:1194
Tue Dec  5 17:51:49 2017 UDPv4 link remote: [AF_UNSPEC]
Tue Dec  5 17:51:49 2017 GID set to nogroup
Tue Dec  5 17:51:49 2017 UID set to nobody
Tue Dec  5 17:51:49 2017 MULTI: multi_init called, r=256 v=256
Tue Dec  5 17:51:49 2017 IFCONFIG POOL: base=192.168.255.4 size=62, ipv6=0
Tue Dec  5 17:51:49 2017 Initialization Sequence Completed
Tue Dec  5 17:53:08 2017 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Dec  5 17:53:08 2017 TLS Error: incoming packet authentication failed from [AF_INET]CLI.ENT.IP.REMOVED:55501
Tue Dec  5 17:53:10 2017 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Dec  5 17:53:10 2017 TLS Error: incoming packet authentication failed from [AF_INET]CLI.ENT.IP.REMOVED:55501
Tue Dec  5 17:53:14 2017 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Dec  5 17:53:14 2017 TLS Error: incoming packet authentication failed from [AF_INET]CLI.ENT.IP.REMOVED:55501
Tue Dec  5 17:53:22 2017 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Dec  5 17:53:22 2017 TLS Error: incoming packet authentication failed from [AF_INET]CLI.ENT.IP.REMOVED:55501
Tue Dec  5 17:53:38 2017 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Dec  5 17:53:38 2017 TLS Error: incoming packet authentication failed from [AF_INET]CLI.ENT.IP.REMOVED:55501

I've removed the IPS from the server and the client. As it can be seen from the logs, the client reaches the server but the authentication fails.

Client description

Ubuntu 16.04 machine, I just imported the user.ovpn file to create the vpn connection so in theory all client options have been setup from the provided OVPN file.

Server description

Ubuntu 16 DigitalOcean droplet, performed installation steps described in the readme as root user.

[jsolla]

Looks like I found what the problem is:

The generated client_config.ovpn file includes these 2 declarations at the bottom of the file, just after the key/certs:

key-direction 1
redirect-gateway def1

Turns out UBUNTU network manager UI ignores those declarations if they are at the bottom of the file when the VPN is created using the Networkmanager (Network > Add > Import a saved VPN configuration).

The issue can be fixed just moving those declarations at the beggining of the .ovpn file. So it ends up looking like this:

nobind
dev tun
remote-cert-tls server
key-direction 1
redirect-gateway def1
remote SER.VER.IP.ADDR 1194 udp

....certs...ca, etc

[frebib]

Fixed in https://github.com/kylemanna/docker-openvpn/pull/351?

[w2ak]

@jsolla I do agree with @frebib. I might have fixed this in #351. Could you please check and tell us?

[jsolla]

I'll give it a try this week, will update the results and close this issue if fixed.

[jsolla]

Confirmed, it works now. At least with ubuntu 16.
I can observe the client_config.ovpn file generated contains the definition "key-direction 1" before the certs, so looks like the network manager is now happy to parse it properly.