I'm trying to set up a system in Linux where OpenVPN tunnels are authenticated but the actual traffic is not encrypted. With one server and one client everything is working fine. Here are the relevant parts of the conf files:
server.conf:
port 1194
proto udp
mode server
tls-server
topology subnet
push "topology subnet"
dev tun
#Keys and certificates
ca /usr/share/vpn/keys/ca.crt
cert /usr/share/vpn/keys/server.crt
key /usr/share/vpn/keys/server.key
dh /usr/share/vpn/keys/dh1024.pem
#Network settings
ifconfig 10.8.0.2 255.255.224.0
push "route-gateway 10.8.0.2"
ifconfig-pool 10.8.0.1 10.8.31.254 255.255.224.0
#Allowing of connections with same common names
duplicate-cn
#Data persisting over reload
persist-key
persist-tun
#Client to client communication
client-to-client
#Encryption
cipher none
#Authentication
auth SHA384
Example client.conf:
client
port 1194
proto udp
topology subnet
dev tun
#Network settings
remote a.b.c.d 1194 # <- Actual IP address of server goes here
#Keys and certificates
ca /usr/share/vpn/keys/ca.crt
cert /usr/share/vpn/keys/5.crt
key /usr/share/vpn/keys/5.key # This file should be kept secret
#Data persisting over reload
persist-key
persist-tun
#Encryption
cipher none
#Authentication
auth SHA384
Waht happens is, that the first client to connect always works. But when the next client connects, the connection is seemingly initialized correctly:
5/10.10.32.5:1194 Data Channel: using negotiated cipher 'AES-256-GCM'
5/10.10.32.5:1194 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 AF:14/121 ]
5/10.10.32.5:1194 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
5/10.10.32.5:1194 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
But when traffic is sent, the following error is seen:
Float requested for peer 0 to 10.10.32.5:1194
AEAD Decrypt error: cipher final failed
All clients are configured identically, and the first client to connect always works.
I tried adding "float" to the server conf, but that changed nothing.
I also added ncp-disable to all configs, even though I would prefer to have the initial handshake, but that just changed the error:
Authenticate/Decrypt packet error: missing authentication info
Authenticate/Decrypt packet error: missing authentication info
Authenticate/Decrypt packet error: packet HMAC authentication failed
Authenticate/Decrypt packet error: packet HMAC authentication failed
Does anyone know how to get OpenVPN working with authentication but no encryption, with multiple clients?
