--tls-auth: is direction needed?

[x-yuri]

Hi there,

I wanted to put the tls-auth key into the client config (<tls-auth></tls-auth>), but this way there are supposedly no way to specify the direction. And with direction 0 on the server, and unspecified on the client it doesn't work:

Apr 03 11:32:34 hostname openvpn[1598]: Authenticate/Decrypt packet error: packet HMAC authentication failed
Apr 03 11:32:34 hostname openvpn[1598]: TLS Error: incoming packet authentication failed from [AF_INET]xx.xxx.xx.xxx:35966

If I have it unspecified on both the client and the server it works. Is that okay to not specify the direction? Or should I keep the tls-auth key in a separate file and always specify the direction?

[x-yuri]

Indeed, this way it doesn't work:

server: tls-auth-key ta.key 0
client: <tls-auth-key>...</tls-auth-key>

This way it does:

server: tls-auth-key ta.key 0
client: <tls-auth-key>...</tls-auth-key>
        key-direction 1

Thanks.

[Pippin]

Hi there,

I wanted to put the tls-auth key into the client config (<tls-auth></tls-auth>), but this way there are supposedly no way to specify the direction.

Please see

--tls-auth args
--key-direction

in manual 2.6:

https://build.openvpn.net/man/openvpn-2.6/openvpn.8.html

[x-yuri]

Indeed, this way it doesn't work:

server: tls-auth-key ta.key 0
client: <tls-auth-key>...</tls-auth-key>

This way it does:

server: tls-auth-key ta.key 0
client: <tls-auth-key>...</tls-auth-key>
        key-direction 1

Thanks.