AEAD Decrypt error

[StarsFall 0]

Hi,

I am getting an AEAD Decrypt error: bad packet ID error occasionally when using airvpn.
This leads me to be unable to access the internet for about a minute or 2 and could also cause the vpn to disconnect/reconnect as well.

Does anybody know what it is and how to fix it?

 

Eddie_20200215_132924.txt

[OpenSourcerer 1442]

It only happens with UDP. TCP works around this problem.
Usually it means that something on your line is doing Quality of Service "optimizations" like reordering or rerouting packets on the fly. DOCSIS (TV cable)-based internet access is known for that, but I'd look in your own network first and look at firewalls you might be using on your PC or the router. Some of the latter have things like "UDP flood protection" or "QoS" on.

[BlueBanana 39]

I am getting those errors too every now and then, but they normally shouldn't lead to a complete disconnection of the VPN.

Packet loss over UDP is very common, unfortunately. It can occur due to an improperly configured MTU size and / or a bad line to the destination server.

You can however suppress those erros by adding "mute-replay-warnings" under "OVPN directivies" in the Eddie client.

[OpenSourcerer 1442]

8 minutes ago, BlueBanana said:

Packet loss over UDP is very common, unfortunately. It can occur due to an improperly configured MTU size and / or a bad line to the destination server.

This message does not indicate lost packages but packages which seem retransmitted and are therefore dropped, causing the connection outages OP mentions – that is, if enough packets are being missed for the apps to "notice" something is not right. The smaller your bandwidth the more probable outages become.
Since TCP guarantees a strict order and retransmission upon lost packets, the message, by principle, can never be seen there. But! The problem introduces something called the TCP-over-TCP problem and starts occuring when making connections in the browser, in apps, etc. over TCP while connected with AirVPN over TCP.
 

39 minutes ago, BlueBanana said:

You can however suppress those erros by adding "mute-replay-warnings" under "OVPN directivies" in the Eddie client.

While true, I tend to dig deeper and find out why they appear in the first place.

[BlueBanana 39]

14 minutes ago, giganerd said:

While true, I tend to dig deeper and find out why they appear in the first place.

"Tarf" (Latvia) is the only server i am getting those AEAD errors. My connection parameters are optimized (at least i think so), and the routers' firewall is turned off. So there is not much i can do on the client side.  Maybe the line to Latvia is just bad.. Who knows...

[StarsFall 0]

15 hours ago, giganerd said:

It only happens with UDP. TCP works around this problem.
Usually it means that something on your line is doing Quality of Service "optimizations" like reordering or rerouting packets on the fly. DOCSIS (TV cable)-based internet access is known for that, but I'd look in your own network first and look at firewalls you might be using on your PC or the router. Some of the latter have things like "UDP flood protection" or "QoS" on.

I do have QOS enabled on my router.

I will try playing around with the QoS settings along with mute-replay-warnings  and see if this error still pops up.
Thank you @giganerd and @BlueBanana.

[OpenSourcerer 1442]

Be sure to come back and share what you've found, even if it was successful.

[Lee47 23]

I recently posted a similar thread few weeks ago about these Bad packet errors here:
 I ran through every mss fix number from 1500 down to 1200 but the bad packet errors still persisted sadly, only 2 fixes was to change to TCP which gave me a 50-70% performance drop in torrent speeds and surfing was very slow the other fix was to try WireGuard protocol, this fixed all my bad packet issues and connection dropping problems.

I do not recommend WireGuard just yet, its not very privacy friendly compared to OpenVPN, but hopefully WireGuard improves soon.