ASUS AC68U (merlin 378.56 beta2) - auth sha256 / auth sha512

[winter]

Hi, I tried to change the default auth sha1 to either auth sha256 or auth sha512 on both the client and server side. Neither will connect and the same error message will appear on the router log: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]

When I add auth sha256 or auth sha512, the server seems to start up just fine as if use default auth sha1. However, when add the same line to clients (windows openvpn client & ios openvpn connect app), neither client will connect and give same error as listed above. If I remove the command from server and client sides, the connection will work just fine as auth sha1.

I am not sure if I am missing something here or there is an issue on server.

Please help. thanks.

 

[L&LD]

378.56 Beta 2 is now dead. 378.56 final has been released for your model.

Upgrade to that and do a complete and proper reset to factory defaults if you want to track down any remaining bugs in the 378.56 series. For all we know, the final may have fixed your issue already.

 

[RMerlin]

Works for me. I added "auth SHA256" to both the server's custom config field and to my client:

Oct 26 15:16:40 openvpn[11761]: 60.60.60.60:49365 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Oct 26 15:16:40 openvpn[11761]: 60.60.60.60:49365 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 26 15:16:40 openvpn[11761]: 60.60.60.60:49365 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Oct 26 15:16:40 openvpn[11761]: 60.60.60.60:49365 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication

Also make sure your client does support it. I'm using the Win32 OpenVPN 2.3.7 client here.

 

[winter]

Finally figured out what went wrong. The auth sha256 command line has to be add right after the server address part before others. I was put it at end and that is what made it fail and said the error listed in the original post. Didn't know the location matters within the client configuration file. Solved and case closed. Thanks to all.


Sent from my iPhone using Tapatalk