Hello! Unfortunately, some of our points still uses blowfish, but we can't change cipher on all of them once,
so we decided to upgrade servers to 2.4.0 and then , one by one, change client's ciphers. Don't know why, but I decided to set default cipher on server to AES-256-CBC , and ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC so blowfish is in list. and found that servers successfully uses blowfish for some old clients, but for others not: client config has no cipher info, i.e. it is default: # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. ;cipher x But during connection server tries to use AES-256 ( i removed client ip). Jan 24 13:00:21 inetgw2 openvpn[11265]: :16900 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Jan 24 13:00:21 inetgw2 openvpn[11265]: :16900 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Jan 24 13:00:21 inetgw2 openvpn[11265]: :16900 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Jan 24 13:00:21 inetgw2 openvpn[11265]: :16900 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Jan 24 13:00:21 inetgw2 openvpn[11265]: :16900 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 1024 bit RSA this results in fail: Jan 24 13:00:34 inetgw2 openvpn[11265]: turetskoye:16900 Authenticate/Decrypt packet error: cipher final failed This is OpenVPN 2.3.2 i486-unknown-linux-uclibc [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Nov 6 2014 the same problem is for OpenVPN 2.3.0 arm-buildroot-linux-uclibcgnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Oct 28 2014 So, for now, I left default cipher on server. But, according to man servers has to choose blowfish: " to allow for more smooth transition, if NCP is enabled, OpenVPN will inherit the cipher of the peer if that cipher is different from the local --cipher setting, but the peer cipher is one of the ciphers specified in --ncp-ciphers. E.g. a non-NCP client (<=2.3, or with --ncp-disabled set) connecting to a NCP server (2.4+) with "--cipher BF-CBC" and "--ncp-ciphers AES-256-GCM:AES-256-CBC" set can either specify "--cipher BF-CBC" or "--cipher AES-256-CBC" and both will work." Right? Or what I'm doing wrong? Thank you! ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users