Question on a sporadic OpenVPN errors:"AEAD Decrypt error", "tls-crypt unwrap error"

--===============4500283341510166316==
Content-Language: de-DE
Content-Type: multipart/alternative;
	boundary="_000_DB8PR10MB3676A875EAB5366F7DE59DD9EEDBADB8PR10MB3676EURP_"

--_000_DB8PR10MB3676A875EAB5366F7DE59DD9EEDBADB8PR10MB3676EURP_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hello,

I have a rather sporadic problem on an OpenVPN setup between different embe=
dded devices, and would like to ask if anybody of you has an idea on what I=
 could do wrong. I was debugging and searching around for quite some time o=
n this now, and ran out of explanations.

I connected several devices to an OpenVPN server, using the following optio=
ns (excerpt of client config file without certificates and keys), OpenVPN v=
ersion is 2.6.14:

##########################
# config:
tls-version-min 1.2
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AE=
S_128_GCM_SHA256:TLS_AES_128_CCM_SHA256
tls-cipher ECDHE+AESGCM:ECDHE+AESCCM:DHE+AESGCM:DHE+AESCCM:!AESCCM8
tls-groups X25519:brainpoolP256r1:secp256r1:X448:brainpoolP384r1:secp384r1:=
brainpoolP512r1:secp521r1

data-ciphers CHACHA20-POLY1305:AES-256-GCM
data-ciphers-fallback AES-256-GCM

auth sha512
verb 3
explicit-exit-notify 1
# reneg-sec is set on both server and client to 3600s:
reneg-sec 3600
ping 30
ping-restart 60
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>
remote-cert-tls server
key-direction 1
client
lport 2196
remote XXX.XX.XXX.XX
remote-cert-tls server
##########################

The connection between these devices mostly works fine for a few hours (typ=
. 24h - 300h, or less, happens sporadically), inlcuding re-keying. After th=
e error shows up once, the connection gets interrupted by TLS crypt errors =
and re-established every hour during the key exchange phase, depending on t=
he setting of "reneg-sec" parameter. For example, if I set the "reneg-sec" =
parameter to 24h, it seems to happen fewer times than before, but then agai=
n every ~24 hours, once the error occured.
After a few OpenVPN reconnect attempts, the connection continues for anothe=
r 1 hour without problems.

I've debugged the network traffic on both client and server during key rene=
gotiation phase, no packet loss, packet source and dest IPs seem ok.

In case this error happens, I need to completely teardown and restart the O=
penVPN client, and after that it works fine for a few hours again.

OpenVPN logs on client side look like the following every hour after the er=
ror occured once:

##########################
...
2025-11-27 09:28:36.453 [openvpn1][NOTICE] Protocol options: explicit-exit-=
notify 1, protocol-flags cc-exit tls-ekm dyn-tls-crypt
2025-11-27 09:29:06.156 [openvpn1][ERR] AEAD Decrypt error: cipher final fa=
iled
2025-11-27 09:29:11.727 [openvpn1][ERR] AEAD Decrypt error: cipher final fa=
iled
<<< KEY EXCHANGE (soft reset, initiated by server)
2025-11-27 10:25:00.271 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed
2025-11-27 10:25:00.272 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:25:02.494 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed
2025-11-27 10:25:02.494 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:25:06.281 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed
2025-11-27 10:25:06.282 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:25:14.391 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed
2025-11-27 10:25:14.391 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:25:29.563 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed
2025-11-27 10:25:29.563 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:26:00.533 [openvpn1][NOTICE] TLS: Initial packet from [AF_INE=
T]XXX.XX.XXX.XX:2196, sid=3Deb6abf41 43fb8ec7
2025-11-27 10:26:01.378 [openvpn1][NOTICE] SIGTERM received, sending exit n=
otification to peer
2025-11-27 10:26:01.378 [openvpn1][NOTICE] SENT CONTROL [serverAussen]: 'EX=
IT' (status=3D1)
2025-11-27 10:26:01.769 [openvpn1][NOTICE] VERIFY OK: -----
2025-11-27 10:26:01.776 [openvpn1][NOTICE] VERIFY KU OK
2025-11-27 10:26:01.777 [openvpn1][NOTICE] Validating certificate extended =
key usage
2025-11-27 10:26:01.777 [openvpn1][NOTICE] ++ Certificate has EKU (str) TLS=
 Web Server Authentication, expects TLS Web Server Authentication
2025-11-27 10:26:01.778 [openvpn1][NOTICE] VERIFY EKU OK
2025-11-27 10:26:01.778 [openvpn1][NOTICE] VERIFY OK: XXX
2025-11-27 10:26:12.462 [openvpn1][NOTICE] OpenVPN 2.6.14 armv7a-hardfloat-=
linux-gnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH/PKTINFO] [AEAD]
2025-11-27 10:26:12.462 [openvpn1][NOTICE] library versions: OpenSSL 3.5.0 =
8 Apr 2025, LZO 2.10
2025-11-27 10:26:12.478 [openvpn1][NOTICE] TCP/UDP: Preserving recently use=
d remote address: [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:26:12.479 [openvpn1][NOTICE] Socket Buffers: R=3D[196608-&gt;=
196608] S=3D[196608-&gt;196608]
2025-11-27 10:26:12.480 [openvpn1][NOTICE] UDPv4 link local (bound): [AF_IN=
ET][undef]:2196
2025-11-27 10:26:12.480 [openvpn1][NOTICE] UDPv4 link remote: [AF_INET]XXX.=
XX.XXX.XX:2196
2025-11-27 10:26:12.483 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)
2025-11-27 10:26:14.446 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)
2025-11-27 10:26:16.333 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_CONTROL_V1)
2025-11-27 10:26:18.456 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)
2025-11-27 10:26:26.072 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)
2025-11-27 10:26:32.536 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_CONTROL_V1)
2025-11-27 10:26:42.751 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)
2025-11-27 10:27:12.769 [openvpn1][NOTICE] [UNDEF] Inactivity timeout (--pi=
ng-restart), restarting
2025-11-27 10:27:12.769 [openvpn1][NOTICE] SIGUSR1[soft,ping-restart] recei=
ved, process restarting
2025-11-27 10:27:12.770 [openvpn1][NOTICE] Restart pause, 1 second(s)
2025-11-27 10:27:13.310 [openvpn1][NOTICE] TCP/UDP: Preserving recently use=
d remote address: [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:27:13.311 [openvpn1][NOTICE] Socket Buffers: R=3D[196608-&gt;=
196608] S=3D[196608-&gt;196608]
2025-11-27 10:27:13.312 [openvpn1][NOTICE] UDPv4 link local (bound): [AF_IN=
ET][undef]:2196
2025-11-27 10:27:13.312 [openvpn1][NOTICE] UDPv4 link remote: [AF_INET]XXX.=
XX.XXX.XX:2196
2025-11-27 10:27:13.316 [openvpn1][NOTICE] SIGTERM received, sending exit n=
otification to peer
2025-11-27 10:27:24.024 [openvpn1][NOTICE] OpenVPN 2.6.14 armv7a-hardfloat-=
linux-gnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH/PKTINFO] [AEAD]
2025-11-27 10:27:24.024 [openvpn1][NOTICE] library versions: OpenSSL 3.5.0 =
8 Apr 2025, LZO 2.10
2025-11-27 10:27:24.040 [openvpn1][NOTICE] TCP/UDP: Preserving recently use=
d remote address: [AF_INET]XXX.XX.XXX.XX:2196
2025-11-27 10:27:24.041 [openvpn1][NOTICE] Socket Buffers: R=3D[196608-&gt;=
196608] S=3D[196608-&gt;196608]
2025-11-27 10:27:24.042 [openvpn1][NOTICE] UDPv4 link local (bound): [AF_IN=
ET][undef]:2196
2025-11-27 10:27:24.042 [openvpn1][NOTICE] UDPv4 link remote: [AF_INET]XXX.=
XX.XXX.XX:2196
2025-11-27 10:27:24.045 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)
...
##########################

Could anybody please give me a hint what potential root causes of these TLS=
 errors could be, especially "AEAD Decrypt error" and "tls-crypt unwrap err=
or", together with "unroutable control packet received"?
Could this be a routing issue, e.g. control packets are routed to wrong cli=
ents, and therefore the packet authentication fails?

I'm sorry that I cannot give information on how to reproduce the error, all=
 I currently know is to wait until it shows up sometimes.

Thank you very much in advance!

Stefan


--_000_DB8PR10MB3676A875EAB5366F7DE59DD9EEDBADB8PR10MB3676EURP_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">Hello,</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">I have a rathe=
r sporadic&nbsp;problem on an OpenVPN setup between different embedded devi=
ces, and would like to ask if anybody of you has an idea on what I could do=
 wrong. I was debugging and searching around
 for quite some time on this now, and ran out of explanations.</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">I connected se=
veral devices to an OpenVPN server, using the following options (excerpt of=
 client config file without certificates and keys), OpenVPN version is 2.6.=
14:</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
##########################</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
# config:</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
tls-version-min 1.2</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AE=
S_128_GCM_SHA256:TLS_AES_128_CCM_SHA256</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
tls-cipher ECDHE+AESGCM:ECDHE+AESCCM:DHE+AESGCM:DHE+AESCCM:!AESCCM8</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
tls-groups X25519:brainpoolP256r1:secp256r1:X448:brainpoolP384r1:secp384r1:=
brainpoolP512r1:secp521r1</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
data-ciphers CHACHA20-POLY1305:AES-256-GCM</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
data-ciphers-fallback AES-256-GCM</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
auth sha512</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
verb 3</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
explicit-exit-notify 1</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
# reneg-sec is set on both server and client to 3600s:</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
reneg-sec 3600</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
ping 30</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
ping-restart 60</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">&lt;tls-auth&gt;</span>=
</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">-----BEGIN OpenVPN Stat=
ic key V1-----</span></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">...</span></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">-----END OpenVPN Static=
 key V1-----</span></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">&lt;/tls-auth&gt;</span=
></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
remote-cert-tls server</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">key-direction 1</span><=
/div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">client</span></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">lport 2196</span></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">remote XXX.XX.XXX.XX</s=
pan></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
<span style=3D"background-color: rgba(0, 0, 0, 0);">remote-cert-tls server<=
/span></div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
##########################</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">The connection=
 between these devices mostly works fine for a few hours (typ. 24h - 300h, =
or less, happens sporadically), inlcuding re-keying. After the error shows =
up once, the connection gets interrupted
 by TLS crypt errors and re-established every hour during the key exchange =
phase, depending on the setting of &quot;reneg-sec&quot; parameter. For exa=
mple, if I set the &quot;reneg-sec&quot; parameter to 24h, it seems to happ=
en fewer times than before, but then again every ~24
 hours, once the error occured.</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">After a few Op=
enVPN reconnect attempts, the connection continues for another 1 hour witho=
ut problems.</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">I've debugged =
the network traffic on both client and server during key renegotiation phas=
e, no packet loss, packet source and dest IPs seem ok.</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">In case this e=
rror happens, I need to completely teardown and restart the OpenVPN client,=
 and after that it works fine for a few hours again.</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">OpenVPN logs o=
n client side look like the following every hour after the error occured on=
ce:</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
##########################</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
...</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 09:28:36.453 [openvpn1][NOTICE] Protocol options: explicit-exit-=
notify 1, protocol-flags cc-exit tls-ekm dyn-tls-crypt</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 09:29:06.156 [openvpn1][ERR] AEAD Decrypt error: cipher final fa=
iled</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 09:29:11.727 [openvpn1][ERR] AEAD Decrypt error: cipher final fa=
iled</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
&lt;&lt;&lt; KEY EXCHANGE (soft reset, initiated by server)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:00.271 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:00.272 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:02.494 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:02.494 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:06.281 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:06.282 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:14.391 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:14.391 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:29.563 [openvpn1][ERR] tls-crypt unwrap error: packet auth=
entication failed</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:25:29.563 [openvpn1][ERR] TLS Error: tls-crypt unwrapping fai=
led from [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:00.533 [openvpn1][NOTICE] TLS: Initial packet from [AF_INE=
T]XXX.XX.XXX.XX:2196, sid=3Deb6abf41 43fb8ec7</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.378 [openvpn1][NOTICE] SIGTERM received, sending exit n=
otification to peer</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.378 [openvpn1][NOTICE] SENT CONTROL [serverAussen]: 'EX=
IT' (status=3D1)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.769 [openvpn1][NOTICE] VERIFY OK: -----</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.776 [openvpn1][NOTICE] VERIFY KU OK</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.777 [openvpn1][NOTICE] Validating certificate extended =
key usage</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.777 [openvpn1][NOTICE] ++ Certificate has EKU (str) TLS=
 Web Server Authentication, expects TLS Web Server Authentication</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.778 [openvpn1][NOTICE] VERIFY EKU OK</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:01.778 [openvpn1][NOTICE] VERIFY OK: XXX</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:12.462 [openvpn1][NOTICE] OpenVPN 2.6.14 armv7a-hardfloat-=
linux-gnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH/PKTINFO] [AEAD]</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:12.462 [openvpn1][NOTICE] library versions: OpenSSL 3.5.0 =
8 Apr 2025, LZO 2.10</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:12.478 [openvpn1][NOTICE] TCP/UDP: Preserving recently use=
d remote address: [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:12.479 [openvpn1][NOTICE] Socket Buffers: R=3D[196608-&amp=
;gt;196608] S=3D[196608-&amp;gt;196608]</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:12.480 [openvpn1][NOTICE] UDPv4 link local (bound): [AF_IN=
ET][undef]:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:12.480 [openvpn1][NOTICE] UDPv4 link remote: [AF_INET]XXX.=
XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:12.483 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:14.446 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:16.333 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_CONTROL_V1)</div=
>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:18.456 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:26.072 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:32.536 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_CONTROL_V1)</div=
>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:26:42.751 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:12.769 [openvpn1][NOTICE] [UNDEF] Inactivity timeout (--pi=
ng-restart), restarting</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:12.769 [openvpn1][NOTICE] SIGUSR1[soft,ping-restart] recei=
ved, process restarting</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:12.770 [openvpn1][NOTICE] Restart pause, 1 second(s)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:13.310 [openvpn1][NOTICE] TCP/UDP: Preserving recently use=
d remote address: [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:13.311 [openvpn1][NOTICE] Socket Buffers: R=3D[196608-&amp=
;gt;196608] S=3D[196608-&amp;gt;196608]</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:13.312 [openvpn1][NOTICE] UDPv4 link local (bound): [AF_IN=
ET][undef]:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:13.312 [openvpn1][NOTICE] UDPv4 link remote: [AF_INET]XXX.=
XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:13.316 [openvpn1][NOTICE] SIGTERM received, sending exit n=
otification to peer</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:24.024 [openvpn1][NOTICE] OpenVPN 2.6.14 armv7a-hardfloat-=
linux-gnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH/PKTINFO] [AEAD]</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:24.024 [openvpn1][NOTICE] library versions: OpenSSL 3.5.0 =
8 Apr 2025, LZO 2.10</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:24.040 [openvpn1][NOTICE] TCP/UDP: Preserving recently use=
d remote address: [AF_INET]XXX.XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:24.041 [openvpn1][NOTICE] Socket Buffers: R=3D[196608-&amp=
;gt;196608] S=3D[196608-&amp;gt;196608]</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:24.042 [openvpn1][NOTICE] UDPv4 link local (bound): [AF_IN=
ET][undef]:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:24.042 [openvpn1][NOTICE] UDPv4 link remote: [AF_INET]XXX.=
XX.XXX.XX:2196</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
2025-11-27 10:27:24.045 [openvpn1][ERR] TLS Error: Unroutable control packe=
t received from [AF_INET]XXX.XX.XXX.XX:2196 (si=3D3 op=3DP_ACK_V1)</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
...</div>
<div style=3D"font-family: Consolas, Courier, monospace; font-size: 10pt; c=
olor: rgb(0, 0, 0);" class=3D"elementToProof">
##########################</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">Could anybody =
please give me a hint what potential root causes of these TLS errors could =
be, especially &quot;AEAD Decrypt error&quot; and &quot;tls-crypt unwrap er=
ror&quot;, together with &quot;unroutable control packet received&quot;?</d=
iv>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
Could this be a routing issue, e.g. control packets are routed to wrong cli=
ents, and therefore the packet authentication fails?</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">I'm sorry that=
 I cannot give information on how to reproduce the error, all I currently k=
now is to wait until it shows up sometimes.</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">Thank you very=
 much in advance!</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof"><br>
</div>
<div style=3D"color: rgb(0, 0, 0);" class=3D"elementToProof">Stefan</div>
<div class=3D"elementToProof"><br>
</div>
</body>
</html>

--_000_DB8PR10MB3676A875EAB5366F7DE59DD9EEDBADB8PR10MB3676EURP_--


--===============4500283341510166316==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============4500283341510166316==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users

--===============4500283341510166316==--