TLS-CRYPT didn't work - needed to manually change the config files to TLS-AUTH

[valueerrorx]

i've installed openvpn on my server with this script, created a user and then imported the .ovpn file in networkmanager on my workstation

the connection couldn't be established:
error on serverside:

tls-crypt unwrap error: packet too short
tls Error: tls-crypt unwrapping failed from ...

(obviously i installed it with tls-crypt)

the server runs ubuntu 20.04 OpenVPN 2.4.7
my workstation runs arch linux OpenVPN 2.4.9

i had to change
tls-crypt tls-crypt.key
to
tls-auth tls-crypt.key
in
/etc/openvpn/server.conf

and i manually edited the .ovpn file and changed the <tls-crypt> part to <tls-auth>before i imported the connection to networkmanager.. this created a file named tls_auth.key and used it to authenticate > everything worked!

so i need to setup openvpn with tls-auth (even if it says tls-crypt (recommended) in the code )
any idea why this was necessary?

[valueerrorx]

you have hidden this setting under

Do you want to customize encryption settings?
Unless you know what you're doing, you should stick with the default parameters provided by the script.

so i went with the default and it didn't work out of the box..

i reinstalled with tls-auth and everything worked out of the box

[randshell]

imported the connection to networkmanager..

Duplicate of #312

---

• I searched the issues

Please next time don't delete the issue template.

[valueerrorx]

sry.. i've searched the "active" issues (because this obviously is still a problem in kubuntu 20.04 and manjaro/arch kde) and there was nothing..

so i wait for a networkmanager update (which should have landed 2 years ago) ?

[randshell]

so i wait for a networkmanager update (which should have landed 2 years ago) ?

tls-crypt support landed from 1.2.10 in the package network-manager-openvpn, that's 3 years ago. Make sure you have that package installed, if it still doesn't work try opening an issue at https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues

[randshell]

Tested on Debian 10 by installing both network-manager-openvpn and network-manager-openvpn-gnome (I don't know what's the difference) and it connected successfully. It looks like they fixed it so again make sure you have both packages installed.

[valueerrorx]

thank you!

i installed the package(s) on both - the ubuntu 20.04 server and on a 20.04 client
(btw. if these are necessary the installer should probably install them)

i also tried a manjaro client and installed a package called
extra/networkmanager-openvpn 1.8.12-1
(even though it already had openvpn capabilities - if it hadn't it would have said something like "missing vpn module"
unfortunately all of this changed nothing..

there was a promising package in AUR called
aur/networkmanager-openvpn-tls-crypt 1.2.8-1
it's outdated and doesn't install anymore

usually those things work on manjaro/arch.. so i'm looking at you ubuntu server ;-)
need more time to investigate :-/

[randshell]

(btw. if these are necessary the installer should probably install them)

The script configures openvpn on the server, those packages are needed on the client to connect. Maybe a FAQ entry would be useful though @angristan

unfortunately all of this changed nothing..

You could ask for support on an Arch Linux forum, I don't know how else to help because I don't use it.