SOLVED: Cannot connect to VPN using tls-crypt but am good using standard AIRVPN settings

[TDJ211 0]

 Im interested in trying out tls-crypt as I suspect my ISP is capping my speeds to about half of my full 100Mbps connection using OpenVPN. 

 

I can connect just fine using the standard 443 UDP protocol but when I try using the tls-crypt I can never get it to connect. I keep getting this error message in the logs

 

write UDPv4: Permission denied (code=13)

 

Any ideas?

 

EDIT:

OK, after changing back to regular VPN, it appears a reboot is necessary to restore connectivity. So I went back and tried the tls-crypt VPN, rebooted and I finally am getting "Initialization Seqeunce Complete" in logs. I look under OpenVPN status page, and it shows connected. But now im getting this below

 

Oct 7 20:05:31 openvpn 54750 Authenticate/Decrypt packet error: packet HMAC authentication failed

Oct 7 20:05:22 openvpn 54750 Initialization Sequence Completed

 

EDIT2: I FINALLY got this working!! I used TCP port 41185. I got UDP to connect at first, but I was still getting capped. Once I switched to TCP, I finally started getting my full speed. 

 

For all you pfSense users, here's the key to getting this to work

 

1) Use tls-crypt.key

2) tls key usage mode needs to be authentication and encryption

3) auth digest algorithm needs to be sha512

4) Under Interface > Assignments,  change your Interface to new ovpn client.

5) Reboot

6) Profit

 

[flat4 79]

Im interested in trying out tls-crypt as I suspect my ISP is capping my speeds to about half of my full 100Mbps connection using OpenVPN.

 

I can connect just fine using the standard 443 UDP protocol but when I try using the tls-crypt I can never get it to connect. I keep getting this error message in the logs

 

write UDPv4: Permission denied (code=13)

 

Any ideas?

 

EDIT:

OK, after changing back to regular VPN, it appears a reboot is necessary to restore connectivity. So I went back and tried the tls-crypt VPN, rebooted and I finally am getting "Initialization Seqeunce Complete" in logs. I look under OpenVPN status page, and it shows connected. But now im getting this below

 

Oct 7 20:05:31 openvpn 54750 Authenticate/Decrypt packet error: packet HMAC authentication failed

Oct 7 20:05:22 openvpn 54750 Initialization Sequence Completed

 

EDIT2: I FINALLY got this working!! I used TCP port 41185. I got UDP to connect at first, but I was still getting capped. Once I switched to TCP, I finally started getting my full speed.

 

For all you pfSense users, here's the key to getting this to work

 

1) Use tls-crypt.key

2) tls key usage mode needs to be authentication and encryption

3) auth digest algorithm needs to be sha512

4) Under Interface > Assignments, change your Interface to new ovpn client.

5) Reboot

6) Profit

Number 1, exactly where is that located?

 

Sent from my BND-L34 using Tapatalk

[go558a83nk 364]

I’ve been saying this exact stuff re pfsense and tls-crypt since the first gen 2 test server (castor) came online many months ago.

 

Please don’t act like you discovered something new.

[flat4 79]

I’ve been saying this exact stuff re pfsense and tls-crypt since the first gen 2 test server (castor) came online many months ago.

 

Please don’t act like you discovered something new.

Is this aimed at me??

 

Sent from my BND-L34 using Tapatalk

[go558a83nk 364]

 

I’ve been saying this exact stuff re pfsense and tls-crypt since the first gen 2 test server (castor) came online many months ago.

Please don’t act like you discovered something new.

Is this aimed at me??

Sent from my BND-L34 using Tapatalk

No. At the OP.

[flat4 79]

 

 

I’ve been saying this exact stuff re pfsense and tls-crypt since the first gen 2 test server (castor) came online many months ago.

Please don’t act like you discovered something new.

Is this aimed at me??

Sent from my BND-L34 using Tapatalk

No. At the OP.

Ok,

 

Sent from my BND-L34 using Tapatalk

[TDJ211 0]

On 10/11/2018 at 7:36 AM, go558a83nk said:

I’ve been saying this exact stuff re pfsense and tls-crypt since the first gen 2 test server (castor) came online many months ago.

 

Please don’t act like you discovered something new.

Oh lookie at mister big shot over here. You sir are an absolute douchebag. 

I give no fucks if it may have been common knowledge or a stupid question. At least I put in the work in figuring it out myself and not pestering the boards with my inferior intellect..

I was just simply following up with my solution in case anyone in the future stumbles upon this thread with a similar problem. There's nothing more frustrating than scouring all corners of the internet to finally find someone else with the same problem but they were too lazy and inconsiderate to update with the solution. It's like how can you expect help if youre not willing to return the favor? And in this instance, its the entire community and anyone else who visits in the future.

That being said, my apologies, I didnt mean to interrupt you wacking off to yourself in the mirror with your countless IT certs in the background. 



 

[go558a83nk 364]

6 hours ago, TDJ211 said:

Oh lookie at mister big shot over here. You sir are an absolute douchebag. 

I give no fucks if it may have been common knowledge or a stupid question. At least I put in the work in figuring it out myself and not pestering the boards with my inferior intellect..

I was just simply following up with my solution in case anyone in the future stumbles upon this thread with a similar problem. There's nothing more frustrating than scouring all corners of the internet to finally find someone else with the same problem but they were too lazy and inconsiderate to update with the solution. It's like how can you expect help if youre not willing to return the favor? And in this instance, its the entire community and anyone else who visits in the future.

That being said, my apologies, I didnt mean to interrupt you wacking off to yourself in the mirror with your countless IT certs in the background. 



 

I'm no big shot but I don't take the time to post and reply to others without hoping that it's appreciated and that the forum search is used.  That's the big no no around here - not using the forum search.

You see, here's an example of me helping another user with the same problem.  Note that my post is marked as the answer.  I'm not bragging.  What I'm saying is that the help was already here.  But, instead you acted like you'd come to a novel solution and needed to brag to the whole community with a new post of your own.