Arch Linux

Kidmiracleman

Member

Registered: 2017-07-15

Posts: 9

Authenticate/Decrypt packet error: bad packet ID (may be a replay)

Hello,
Today when i was looking my journalctl logs as root i saw these messages/errors. I couldn't find enough information about this error

 nm-openvpn[11087]: Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2156581 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

Error is from two days ago actually. Logs of yesterday and today are clean.

My old openvpn config was this (today i changed it with tcp protocol and aes 256) The script at last three lines is from here vpnfailsafe

client
dev tun
proto udp
remote uk-london.privateinternetaccess.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0
crl-verify crl.rsa.2048.pem
ca ca.rsa.2048.crt
disable-occ
script-security 2
up /etc/openvpn/vpnfailsafe.sh
down /etc/openvpn/vpnfailsafe.sh

I only see these messages if i use journalctl as root, so no error messages when use journalctl command as user. By the way there are hundreds of these messages.
So i googled the error and read about " replay attack " And now i've installed ufw, sshguard, changed my vpn encryption to 256-bit. Maybe i should also encrypt all my hdds and ssds  (:
Probably there is nothing to worry about and all my mail or bank accounts have 2-Step Verification but i want to understand why i got this messages?