If your OpenVPN client is showing errors like
AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)
after the server has been upgraded to OpenVPN 2.5, you might need to configure fallback options. Since OpenVPN 2.4, client and server will try to negotiate the best ciphers that are available to both sides. In OpenVPN 2.5, the automatic fallback to a standard cipher has been disabled (I think), but it can be reenabled on the server with the
data-ciphers-fallback directive. You need to make sure that both server and (pre 2.4) clients use the same cipher. The 2.3 and earlier default is
BF-CBC, which is considered outdated and weak.
I have some older OpenWrt based routers installed at some family members’ homes (for easier remote support), which I cannot easily upgrade remotely. So I had to update both by OpenVPN 2.5 server config by adding this line:
And on the client side, I added this line to the config section in
option cipher 'AES-256-CBC'
After restarting both the server and the clients, the connections are re-established again.
If you’re getting error message like this on the server:
client.example.com/192.168.23.45:49263 Authenticate/Decrypt packet error: cipher final failed
The problem is likely that the fallback cipher on the server does not match the cipher on the client. Double check that the
cipher options specify the same value.
This page shows the matrix of supported ciphers between 2.3, 2.4, and 2.5.
thanks a lot for your article. I feel I’m getting closer to solving my issue thanks to your writeup, but I just can’t seem to finish up the task. I just upgraded my router today to the latest OpenWRT version and I can’t seem to get my OpenVPN to work. I’m on OpenWrt 21.02.0. Could you possibly provide additional guidance? I really don’t know what files I should update.
thank you so much
Important update: my Mac OS works just fine. The problems seems to be with my iPhone. Well, this is an important breakthrough because it means that my OpenVPN works and it is just a matter of figuring out what has changed from 19.07 to OpenWrt 21.02.0 that may impact iOS. Any idea?