cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback

[atkinsom]

I've just noticed this message showing up in my OpenVPN log "Treating option '--ncp-ciphers' as '--data-ciphers' (renamed in OpenVPN 2.5)" and "--cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback" I looked around but I didn't see anything that could tell me why the client and server can't negotiate one of the default ciphers in the list that the router has automatically created.

See below....I'm running the latest Merlin on my AX86U Pro and generated new certs from the router but I keep getting this error in the logs. I know how to get around the issue by using the deprecated BF-CBC in the config file but why is the latest Merlin OpenVPN server generating those errors in the client log and not using the data ciphers already in the list.

Thanks for any guidance if I misunderstand the error.

Data ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305

 

[RMerlin]

Those two messages are warnings, not errors. Just ignore them. The warnings are because for backward compatibility, the config file generated by the router uses backward compatible settings so it can run on 2.4, 2.5 or 2.6.

 

[Martinski]

I've just noticed this message showing up in my OpenVPN log "Treating option '--ncp-ciphers' as '--data-ciphers' (renamed in OpenVPN 2.5)" and "--cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback"
...
Data ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305

If you would like to get rid of those 2 warnings in the client log, you can make 2 simple changes in the OpenVPN Client configuration file:

1) Change "ncp-ciphers" to "data-ciphers" keyword
FROM:

ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305

TO:

data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305

2) Add the following line after the "data-ciphers" line:

cipher AES-256-GCM

That's all. No changes are needed in the router's OpenVPN Server.