☰

OpenVPN 身份验证/解密数据包错误

tag-icon • tag-icon ssl openvpn windows-10 ubuntu-16.04
OpenVPN 身份验证/解密数据包错误

我正在尝试将运行 Windos 10 的笔记本电脑连接到运行 OpenVPN 的 Ubuntu 16.04 服务器。

客户端不断收到此错误：

 MANAGEMENT: >STATE:1491498025,WAIT,,,,,,
 Connection reset, restarting [0]
 SIGUSR1[soft,connection-reset] received, process restarting
 MANAGEMENT: >STATE:1491498025,RECONNECTING,connection-reset,,

我跟着本指南设置 OpenVPN。除了我更改为端口 443 和 tcp 外，其他一切都是默认的。

在服务器上，我看到来自“Systemctl status openvpn@server”的此错误：

 ovpn-server[4627]: [IP ADDR] Fatal TLS error (check_tls_errors_co), restarting
 ovpn-server[4627]: [IP ADDR] SIGUSR1[soft,tls-error] received, client-instance restarting
 ovpn-server[4627]: TCP connection established with [AF_INET][IP ADDR]
 ovpn-server[4627]: [IP ADDR] TLS: Initial packet from [AF_INET][IP ADDR], sid=5bf6806d 9c9b6639
 ovpn-server[4627]:[IP ADDR] Authenticate/Decrypt packet error: packet HMAC authentication failed
 ovpn-server[4627]: [IP ADDR] TLS Error: incoming packet authentication failed from [AF_INET][IP ADDR]
 ovpn-server[4627]: [IP ADDR] Fatal TLS error (check_tls_errors_co), restarting
 ovpn-server[4627]: [IP ADDR] SIGUSR1[soft,tls-error] received, client-instance restarting

服务器配置文件：

port 443
proto tcp
dev tun
ca ca.crt
cert KICLAB-HV-01.crt
key KICLAB-HV-01.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth ta.key 0
key-direction 0 
mode server
tls-server
cipher AES-128-CBC    # AES
auth SHA256           # SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

基础配置：

client
dev tun
proto tcp
remote [Internal LAN IP for testing] 443
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
cipher AES-128-CBC
auth SHA256 
key-direction 1
comp-lzo
verb 3

客户端日志

Attempting to establish TCP connection with [AF_INET][IP:443} [nonblock]
MANAGEMENT: >STATE:1491826387,TCP_CONNECT,,,,,,
TCP connection established with [AF_INET][IP:443}
TCP_CLIENT link local: (not bound)
TCP_CLIENT link remote: [AF_INET][IP:443}
MANAGEMENT: >STATE:1491826388,WAIT,,,,,,
Connection reset, restarting [0]
SIGUSR1[soft,connection-reset] received, process restarting
MANAGEMENT: >STATE:1491826388,RECONNECTING,connection-reset,,,,,
Restart pause, 5 second(s)
TCP/UDP: Preserving recently used remote address: [AF_INET][IP:443}
Socket Buffers: R=[65536->65536] S=[65536->65536]
Attempting to establish TCP connection with [AF_INET][IP:443} [nonblock]
MANAGEMENT: >STATE:1491826393,TCP_CONNECT,,,,,,
TCP connection established with [AF_INET][IP:443}
TCP_CLIENT link local: (not bound)
TCP_CLIENT link remote: [AF_INET][IP:443}
MANAGEMENT: >STATE:1491826394,WAIT,,,,,,
Connection reset, restarting [0]
SIGUSR1[soft,connection-reset] received, process restarting
MANAGEMENT: >STATE:1491826394,RECONNECTING,connection-reset,,,,,
Restart pause, 5 second(s)

“Systemctl Status openvpn@server” 的当前输出（注意，[IP] 实际上不是客户端的正确 IP。这有问题吗？）：

MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
IFCONFIG POOL LIST
MULTI: TCP INIT maxclients=1024 maxevents=1028
Initialization Sequence Completed
TCP connection established with [AF_INET][IP]:48758
[IP]:48758 TLS: Initial packet from [AF_INET][IP]:48758, sid=9ab50ac0 a37efe04
[IP]:48758 TLS Error: reading acknowledgement record from packet
[IP]:48758 Fatal TLS error (check_tls_errors_co), restarting
Apr 10 08:36:24 [host] ovpn-server[2191]: [IP]:48758 SIGUSR1[soft,tls-error] received, client-instance restarting

谢谢！

答案1

您的配置中没有客户端证书。您应该生成一个由你在服务器上使用的同一 CA 签名的并将其添加到 client.conf 中，如下所示：

ca "ca.crt"
cert "client.crt"
key "client.key"

答案2

来自 OpenVPN 网站：

--tls-auth 选项使用静态预共享密钥 (PSK)，必须提前生成并在所有对等方之间共享。

您的服务器上有：

tls-auth ta.key 0 # This file is secret
key-direction 0

但在客户端，你已经将其注释掉了：

;tls-auth ta.key 1
...
key-direction 1

第二个参数tls-auth是键方向，因此您不需要使用该key-direction节重复它。

在您的服务器上，只需删除该key-direction 0行，然后在您的客户端上删除注释分隔符（;）和该key-direction 1行。

当然，ta.key在上述操作真正起作用之前，它还需要首先位于您的客户端计算机上 - 使用scp或类似方法安全地将其复制到那里。

相关内容