CU 178 - Error: negotiated cipher not allowed - AES-256-CBC

[mrelfire]

Hello,
it seems this is the latest thread on this subject:
To day I am using IPFire 2.27 (x86_64) - Mise à jour du noyau 178
I have just upgraded the client openvpn to 2.6.6 and I have the same error

2023-08-21 08:25:23 Error: negotiated cipher not allowed - AES-256-CBC not in AES-256-GCM:AES-128-GCM
2023-08-21 08:25:23 OPTIONS ERROR: failed to import crypto options
2023-08-21 08:25:23 Failed to open tun/tap interface

I am under windows 10 and have in the config

providers legacy default

any suggestions please ?

thanks in advance !

[tphz (iptom)]

@mrelfire

any suggestions please ?

I think that in your case you can try

1. on IPFire WUI->Services->OpenVPN
   change Encryption: to AES-GCM(256 bit)

2. then on the client
   in the .ovpn configuration file
   change the cipher AES-256-CBC to cipher AES-256-GCM

Best

[mrelfire]

thanks but when I change this config, it allways go back to its default
"
AES-CBC (256 bit)
"
did I miss something please ?

[bonnietwin (Adolf Belka)]

@mrelfire

it allways go back to its default

You need to stop the vpn server, then change the cipher, then press save and then start the server again.

[tphz (iptom)]

A little addition to @bonnietwin post

[mrelfire]

thanks !

P.S.
I did have to reboot the sever to see a scree nrefresh when you change this value

[bonnietwin (Adolf Belka)]

Just refresh your browser page.

[mrelfire]

yes but the server was still showing as red not started

[bonnietwin (Adolf Belka)]

Sorry, I misunderstood what your refresh problem was. I thought you meant the status of the client connection.

If the server is failing to start then you need to look in the logs to see what the problem is.

Go to Logs - System Logs in the WUI menu.

Then select OpenVPN in the dropdown box labelled Section: and then press the Update button.

[mrelfire]

We misunderstood each other:

• first problem was the ‘save’ and thank you foryour help I miss it
• second problem is when you start the server you do not have the text+light which change from red to green => in this case I have to restart the server

[dark0ipfire (Martin Bell)]

Will it be possible to change setting cipher AES-256-CBC to cipher AES-256-GCM in file \var\ipfire\ovpn\server.conf, while openvpn server is up and running, so the new cipher setting will be fetched during the next reboot? Obviously I want to do this via an OpenVPN session, so I cannot stop the OpenVPN Server

[bonnietwin (Adolf Belka)]

@dark0ipfire

Will it be possible to change setting cipher AES-256-CBC to cipher AES-256-GCM in file \var\ipfire\ovpn\server.conf, while openvpn server is up and running, so the new cipher setting will be fetched during the next reboot?

I don’t know, without testing or going through the code.

Maybe @ummeegge can give feedback on your question.

[ummeegge (Erik Kapfer)]

Hi all,
i think this should then also be changed in the settings file.

Best,

Erik

[kenzo_ume (James Sly)]

@mrelfire

thanks !

P.S.
I did have to reboot the sever to see a scree nrefresh when you change this value

I think there is a problem with the status refreshing on the OpenVPN main page. Happens with the connection status too ie need to reboot the server to get the correct status to display.

[roberto (Roberto Peña)]

I solve this error by modifying the .OVPN file with this:

Where it says “cipher AES-256-CBC”, put “data-ciphers AES-256-CBC”.

Bye.

[kenzo_ume (James Sly)]

@roberto

I solve this error by modifying the .OVPN file with this:

Where it says “cipher AES-256-CBC”, put “data-ciphers AES-256-CBC”.

For Windows 10 I had to use OpenVPN version 2.6.8 and amend the .ovpn file to include two additional lines:
data-ciphers AES-256-CBC
data-ciphers-fallback AES-256-CBC

In Windows 10 I couldn’t get it to negotiate the ciphers correctly when I tested with OpenVPN versions 2.7 and above.

[tphz (iptom)]

@kenzo_ume

I tested with OpenVPN versions 2.7

Could you please show where this version 2.7 is available?

Version 2.6.8 is available on the official website.

https://community.openvpn.net/openvpn/wiki/StatusOfOpenvpn27

Release is roughly planned for two years after OpenVPN 2.6. So end of 2024 or beginning of 2025.

Regards

[kenzo_ume (James Sly)]

@tphz

@kenzo_ume

I tested with OpenVPN versions 2.7

Could you please show where this version 2.7 is available?

Sorry, I should have been more explicit. Version 2.6.8 is the community version. I also tested this version
https://openvpn.net/downloads/openvpn-connect-v2-windows.msi
which is OpenVPN Connect version 2.7.1. It didn’t work for me.
I couldn’t get OpenVPN Connect v3 to work (using the .p12, ta.key and .ovpn files from IPFire) on Windows 10.

[tphz (iptom)]

I do not use OpenVPN Connect.
Today for a test:
I installed OpenVPN Connect v 3.4.4 (3412) on Windows 10 Pro 22H2.
I added an OpenVPN test connection on the IPFire CU182.

I configured according to the information available in the Documentation and on the Forum

iOS Keychain Method

Trying to setup OpenVPNs to Orange device

Today I downloaded and installed the openvpn-connect-v3-windows.msi version from: https://openvpn.net/download-open-vpn/ To run the v3 version, I performed the following steps: WUI–>OpenVPN → Global Settings check the TLS Channel Protection option [obraz] Add the RoadWarrior connection [obraz] with PKCS12 File Password [obraz] Download Client Package(zip) [obraz] and unzip to separate folder [obraz] [obraz] Following the below of wiki instructions, copy the downloaded file …

Option_error: sorry unsupported options present in configuration: Option allowed only to be pushed be the server

I just got this myself. The error message isn’t very helpful as it doesn’t list the offending options. But the log does, so commenting out auth-token-user and auth-token makes the connection work. I’m not on iOS 17, btw, still on 16.

Option_error: sorry unsupported options present in configuration: Option allowed only to be pushed be the server

I have commented out the following two lines in my OVPN file. I then deleted the profile in the OpenVPN app and uploaded the new OVPN file to the iPhone and stored it in OpenVPN App as new profile.

It seems to be working

Regards