Introduction

Troubleshooting OpenVPN: Configurations

Cipher mismatches

In this recipe, we will change the cryptographic ciphers that OpenVPN uses. Initially, we will change the cipher only on the client side, which will cause the initialization of the VPN connection to fail. The primary purpose of this recipe is to show the error messages that appear, not to explore the different types of ciphers that OpenVPN supports.

Getting ready

Install OpenVPN 2.0 or higher on two computers. Make sure the computers are connected over a network. Set up the client and server certificates using the first recipe from Chapter 2. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1.

The client was running Fedora 13 Linux and OpenVPN 2.1.1. Keep the configuration file basic-udp-server.conf from the Chapter 2 recipe Server-side routing at hand,

as well as the client configuration file basic-udp-client.conf.

How to do it...

1.Start the server using the configuration file basic-udp-server.conf:

[root@server]# openvpn --config basic-udp-server.conf

2.Next, create the client configuration file by appending a line to the basic-udp-client.conf file:

cipher CAST5-CBC

Save it as example7-1-client.conf.

3.Start the client, after which the following message will appear in the client log:

[root@client]# openvpn --config example7-1-client.conf

…WARNING: 'cipher' is used inconsistently, local='cipher CAST5CBC', remote='cipher BF-CBC'

…[openvpnserver] Peer Connection Initiated with server-ip:1194

…TUN/TAP device tun0 opened

…/sbin/ip link set dev tun0 up mtu 1500

…/sbin/ip addr add dev tun0 192.168.200.2/24 broadcast 192.168.200.255

…Initialization Sequence Completed

…Authenticate/Decrypt packet error: cipher final failed

188

Chapter 7

And, similarly, on the server side:

…client-ip:52461 WARNING: 'cipher' is used inconsistently, local='cipher BF-CBC', remote='cipher CAST5-CBC'

…client-ip:52461 [openvpnclient1] Peer Connection Initiated with openvpnclient1:52461

…openvpnclient1/client-ip:52461 Authenticate/Decrypt packet error: cipher final failed

…openvpnclient1/client-ip:52461 Authenticate/Decrypt packet error: cipher final failed

The connection will not be successfully established, but it will also not be disconnected immediately.

How it works...

During the connection phase, the client and the server negotiate several parameters needed to secure the connection. One of the most important parameters in this phase is the encryption cipher, which is used to encrypt and decrypt all the messages. If the client and server are using different ciphers, then they are simply not capable of talking to each other.

By adding the following configuration directive to the server configuration file, the client and the server can communicate again:

cipher CAST5-CBC

There's more...

OpenVPN supports quite a few ciphers, although support for some of the ciphers is still experimental. To view the list of supported ciphers, type:

$ openvpn --show-ciphers

This will list all ciphers with both variables and fixed cipher length. The ciphers with variable cipher length are very well supported by OpenVPN, the others can sometimes lead to unpredictable results.

TUN versus TAP mismatches

A common mistake when setting up a VPN based on OpenVPN is the type of adapter that is used. If the server is configured to use a TUN-style network but a client is configured to use a TAP-style interface, then the VPN connection will fail. In this recipe, we will show what is typically seen when this common configuration error is made.

189

Troubleshooting OpenVPN: Configurations

Getting ready

Install OpenVPN 2.0 or higher on two computers. Make sure the computers are connected over a network. Set up the client and server certificates using the first recipe from Chapter 2, Client-server IP-only Networks. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Fedora 13 Linux and OpenVPN 2.1.1. Keep the configuration file, basic-udp-server.conf, from the Chapter 2 recipe Server-side routing at hand, as well as the client configuration file basic-udp-client.conf.

How to do it...

1.Start the server using the configuration file basic-udp-server.conf:

[root@server]# openvpn --config basic-udp-server.conf

2.Next, create the client configuration:

client proto udp

remote openvpnserver.example.com port 1194

dev tap nobind

tls-auth /etc/openvpn/cookbook/ta.key 1

ns-cert-type server

Save it as example7-2-client.conf.

3.Start the client:

[root@client]# openvpn --config example7-2-client.conf

The client log willl show:

…WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'

…WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1573', remote='link-mtu 1541'

…WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'

190