Fixing OpenVPN "Authenticate/Decrypt packet error: cipher final failed"

When connecting to a VPN I was constant getting the error

Mar  8 09:29:27 openvpn[1696]: Authenticate/Decrypt packet error: cipher final failed

I had imported the supplied ovpn file and had followed all the other configuration steps, so this was quite frustrating. Then I saw this in the logs:

Mar  8 09:31:07 openvpn[1790]: WARNING: 'cipher' is used inconsistently, local='cipher BF-CBC', remote='cipher AES-256-CBC'

Changing my client to use "cipher AES-256-CBC" instead of the default (which apparently was cipher BF-CBC) fixed the issue.

Comments

Alex said…
It was really helpfull, and decreased the times I have such error. But sometimes I still have "AEAD Decrypt error: cipher final failed" error on server and "Authenticate/Decrypt packet error: packet HMAC authentication failed" on client. I cannot find the root issue and don't see any dependency. The openVPN server restart helps me to fix it temporarily.
4:25 am
Anonymous said…
Thank you. This was posted 4 years ago, and still seems to be relevant.
I've been using an OpenVPN server on a Synology NAS for over 2 years now and suddenly, a day ago, it started failing with the same error. My client is an OSX TunnelBrick client. Adding the cipher explicitly to my client configuration seems to have solved it.
11:06 pm
Anonymous said…
Thank you for the solution. Finally OpenVPN works on my old router (WRT54GL v1.1 using Tomato: 1.28.7636 Toastman-IPT-ND ND VPN).
3:34 pm
Unknown said…
Still relevant in 2020
10:29 pm
Anonymous said…
Yes, still relevant in 2020 =D
12:19 am
lena said…
This comment has been removed by the author.
6:42 pm
casinosite.one said…
The overall look of your web site is great, as well as the content!Feel free to visit my website;
2:59 pm
casinosite777.top said…
Its like you learn my thoughts!
2:59 pm
Van said…
Greeat reading
1:50 pm
바카라사이트 추천 said…
Actually quite helpful data accessible here, Thanks This is very interesting article
2:13 pm
안전놀이터 said…
You have touched some pleasant factors here. Any way keep up writing.
2:21 pm
토토사이트 추천 said…
Very nice blog post, I like this site Keep on sharing! Goodjob bud, Thanks
2:30 pm
파워볼사이트 추천 said…
I am satisfied with your great work. Keep on writing, keep us updated!!
2:44 pm
Post a Comment

Popular posts from this blog

MinHash for dummies

Duplicate document detection is becoming increasingly important for businesses that have huge collections of email, web pages and documents with multiple copies that may or may not be kept up to date. MinHash is a fairly simple algorithm that from all my Googling has been explained very poorly in blogs or in the kind of mathematical terms that I forgot long ago. So in this article I will attempt to explain how MinHash works at a practical code level. Before I start, please take a look at  http://infolab.stanford.edu/~ullman/mmds/ch3.pdf . That document goes into a lot of theory, and was ultimately where my understanding on MinHash came from. Unfortunately it approaches the algorithm from a theoretical standpoint, but if I gloss over some aspect of the MinHash algorithm here, you will almost certainly find a fuller explanation in the PDF. I'll also be using pseudo Java in these examples instead of traditional math. This means when I use terms like Set, I am referring to the gr
Read more

Authenticating via Kerberos with Keycloak and Windows 2008 Active Directory

Image
The following instructions show you how to configure Keycloak with Windows AD in order to use Kerberos authentication. Assumptions The Kerberos realm is VIRTUAL.LOCAL The hostname used to access Keycloak is virtual.local. This just means we are running Keycloak on the domain controller. In production virtual.local will be replaced with something like keycloak.dev.virtual.local or something like that, giving you a SPN of  HTTP/keycloak.dev.virtual.local@VIRTUAL.LOCAL Configuration Create a windows domain account called Keycloak. Run the following command to assign a SPN to the user and generate a keytab file: ktpass -out keycloak.keytab -princ HTTP/virtual.local@VIRTUAL.LOCAL -mapUser Keycloak@VIRTUAL.LOCAL -pass password1! -kvno 0 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT Verify the SPN has been assigned to the user with the command: setspn -l Keycloak Configure the LDAP settings in Keycloak like this. Since we are running Keycloak on the domain controller, we ref
Read more