Docker-openvpn: tls-auth in openvpn.conf not working

[rottmann]

Server log

TLS Error: cannot locate HMAC in incoming packet from [AF_INET]

when i disable the line # tls-auth /etc/openvpn/pki/ta.key it works.

[kylemanna]

Sounds like your client is misconfigured and not sending HMAC signatures.

[rottmann]

Funny error on my mint linux, when i use the ovpn-file and connect manually openvpn my.ovpn it work.
When i import the same ovpn-file in the network manager, i can't connect.

So it is no issue of docker-openvpn (tested also with win7, ubuntu 12.04 LTS, OSX and it works fine).

[kylemanna]

Thanks for the update. Glad to hear you got it working.

I assume Network Manager is messing with your config file. That "tool"... haha. ;)

[conejoninja]

Sorry to bump an old topic, but if anyone find the same issue, you're probably missing to configure your TLS auth key in the (graphical) network manager. First I split the client.ovpn file into several ones (client.crt, ca.crt, client.key,... and ta.key (with what is in between )). While configuring your connection, you need to click on "Advanced" > TLS Authentication tab. Check the "Use additional TLS authentication", select your file (ta.key or whatever you call it) and "1" as key direction. Click Ok and you're done.

[maodomalick14]

I have to install openvpn server on debain after configuration and creation of clients I made the test on the server by executing the command openvpn client.ovpn it sends me this message of errors someone can help me please

Tue Mar 7 14:12:42 2017 TLS Error: cannot locate HMAC in incoming packet from [ AF_INET]154.65.33.243:49816

[breznak]

I'm also having the issue, even with the

Check the "Use additional TLS authentication", select your file (ta.key or whatever you call it) and "1" as key direction

Or also with pure openvpn cli: openvpn --config my.ovpn

What can I disable to verify the rest is working properly?

openvpn output on trying to connect:

$ openvpn  --config my.ovpn
Tue May 16 13:19:25 2017 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Tue May 16 13:19:25 2017 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Enter Private Key Password: *****
Tue May 16 13:19:34 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue May 16 13:19:34 2017 Control Channel Authentication: tls-auth using INLINE static key file
Tue May 16 13:19:34 2017 UDPv4 link local: [undef]
Tue May 16 13:19:34 2017 UDPv4 link remote: [AF_INET]xxx:443
Tue May 16 13:19:34 2017 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]xxx:443

The server config file looks like this:

server 192.168.255.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/xxx.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/xxx.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun

proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log

user nobody
group nogroup
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
cipher AES-256-CFB
auth SHA384
comp-lzo

### Route Configurations Below
route 192.168.254.0 255.255.255.0

### Push Configurations Below
push "block-outside-dns"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

### Extra Configurations Below
remote-cert-eku "TLS Web Client Authentication"
tls-version-min 1.2

[hhysj]

@conejoninja It really works for my linux mint 18.x! thank you so much!

[jonathanfoster]

Just to add to @conejoninja's solution, you can easily split a .opvn config file using https://github.com/rexxars/openvpn-config-splitter. Once you split the file, open network manager, add a new VPN connection, choose "Import from existing file...", and select the newly created .split.ovpn file.