NordVPN connection fail: no shared cipher #2819

dpellegr · 2024-03-29T08:42:49Z

dpellegr
Mar 29, 2024

Hello, many years user here.
I recently noticed that my container was no longer connecting, failing on the auth process, everything else looks good:

Starting container with revision: 07f5a2b9aea5028c9bb75438c1552708e91dde71
TRANSMISSION_HOME is currently set to: /config/transmission-home
WARNING: Deprecated. Found old default transmission-home folder at /data/transmission-home, setting this as TRANSMISSION_HOME. This might break in future versions.
We will fallback to this directory as long as the folder exists. Please consider moving it to /config/transmission-home
Creating TUN device /dev/net/tun
Using OpenVPN provider: NORDVPN
Running with VPN_CONFIG_SOURCE auto
Provider NORDVPN has a bundled setup script. Defaulting to internal config
Executing setup script for NORDVPN
/etc/openvpn/nordvpn/..
INFO: OVPN: Checking curl installation
INFO: OVPN: DNS resolution ok
INFO: OVPN: ok, configurations download site reachable
INFO: OVPN: Removing existing configs in /etc/openvpn/nordvpn
Checking NORDPVN API responses
INFO: OVPN:Selecting the best server...
WARNING: OVPN: empty or invalid NORDVPN_COUNTRY (value=). Ignoring this parameter. Possible values are:AL,DZ,AD,AR, ...
WARNING: OVPN: empty or invalid NORDVPN_CATEGORY (value=). ignoring this parameter. Possible values are: legacy_double_vpn, ...
INFO: OVPN:Searching for technology: openvpn_tcp
INFO: OVPN: Best server : it232.nordvpn.com, load: null
Best server : it232.nordvpn.com
INFO: OVPN: Downloading config: it232.nordvpn.com.ovpn
INFO: OVPN: Downloading from: https://downloads.nordcdn.com/configs/files/ovpn_tcp/servers/it232.nordvpn.com.tcp.ovpn
OVPN: NORDVPN: selected: it232.nordvpn.com, VPN_PROVIDER_HOME: /etc/openvpn/nordvpn
Starting OpenVPN using config it232.nordvpn.com.ovpn
Modifying /etc/openvpn/nordvpn/it232.nordvpn.com.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
adding route to local network 192.168.1.0/24 via 172.17.0.1 dev eth0
2024-03-29 09:09:55 OpenVPN 2.5.9 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 29 2023
2024-03-29 09:09:55 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2024-03-29 09:09:55 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-03-29 09:09:55 NOTE: --fast-io is disabled since we are not using UDP
2024-03-29 09:09:55 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2024-03-29 09:09:55 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2024-03-29 09:09:55 TCP/UDP: Preserving recently used remote address: [AF_INET]178.249.211.7:443
2024-03-29 09:09:55 Socket Buffers: R=[131072->131072] S=[16384->16384]
2024-03-29 09:09:55 Attempting to establish TCP connection with [AF_INET]178.249.211.7:443 [nonblock]
2024-03-29 09:09:55 TCP connection established with [AF_INET]178.249.211.7:443
2024-03-29 09:09:55 TCP_CLIENT link local: (not bound)
2024-03-29 09:09:55 TCP_CLIENT link remote: [AF_INET]178.249.211.7:443
2024-03-29 09:09:55 TLS: Initial packet from [AF_INET]178.249.211.7:443, sid=17e16137 e919e659
2024-03-29 09:09:55 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2024-03-29 09:09:55 VERIFY OK: depth=2, C=PA, O=NordVPN, CN=NordVPN Root CA
2024-03-29 09:09:55 VERIFY OK: depth=1, O=NordVPN, CN=NordVPN CA9
2024-03-29 09:09:55 VERIFY KU OK
2024-03-29 09:09:55 Validating certificate extended key usage
2024-03-29 09:09:55 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2024-03-29 09:09:55 VERIFY EKU OK
2024-03-29 09:09:55 VERIFY X509NAME OK: CN=it232.nordvpn.com
2024-03-29 09:09:55 VERIFY OK: depth=0, CN=it232.nordvpn.com
2024-03-29 09:09:55 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
2024-03-29 09:09:55 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 4096 bit RSA, signature: RSA-SHA512
2024-03-29 09:09:55 [it232.nordvpn.com] Peer Connection Initiated with [AF_INET]178.249.211.7:443
2024-03-29 09:09:57 SENT CONTROL [it232.nordvpn.com]: 'PUSH_REQUEST' (status=1)
2024-03-29 09:09:57 AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)
2024-03-29 09:09:57 SIGTERM[soft,auth-failure] received, process exiting

This is my running command:

docker run --cap-add=NET_ADMIN --dns 1.1.1.1 -d \
              -v /mnt/seasto/Transmission3:/data \
              -v /mnt/seasto/Transmission3:/config \
              -v /etc/localtime:/etc/localtime:ro \
	      -e OPENVPN_PROVIDER=NORDVPN \
              -e OPENVPN_USERNAME=**** \
              -e OPENVPN_PASSWORD=**** \
              -e LOCAL_NETWORK=192.168.1.0/24 \
              --log-driver json-file \
              --log-opt max-size=10m \
	      --restart=always \
              -p 9091:9091 \
              haugene/transmission-openvpn:latest

Is anybody facing the same issue?
Maybe it is server related... how could I try forcing it to connect to another server?

Great thanks

dpellegr · 2024-03-29T08:54:47Z

dpellegr
Mar 29, 2024
Author

Yeah, I was right, definitely a server problem.

I forced another country defining NORDVPN_COUNTRY (see http://haugene.github.io/docker-transmission-openvpn/provider-specific/) and I am up again 🥳

2 replies

ViridisDraco Mar 31, 2024

it was the same with IT, switched to FR and it worked

leelouch Apr 2, 2024

same here ! FR did not work for me ! I had to choose fr949 server !! but it is not a good idea everyone choose the same server :)
this is weird !

kiwidoggie · 2024-03-30T09:37:57Z

kiwidoggie
Mar 30, 2024

I'm also having this issue, but NORDVPN_COUNTRY was already set. Any other hints?

2 replies

dpellegr Mar 30, 2024
Author

I was successful using NORDVPN_COUNTRY=US, but you can also try to connect to a specific server using, for instance, NORDVPN_SERVER=us8498.nordvpn.com

ilike2burnthing Mar 30, 2024

Generally you should just set NORDVPN_COUNTRY, NORDVPN_CATEGORY, and NORDVPN_PROTOCOL, as this will select the best server for you each time. Whereas, if you use NORDVPN_SERVER, then while it might be fine the first time you use it, it could go down or experience issues and the container can't switch.

evellior · 2024-04-02T16:02:06Z

evellior
Apr 2, 2024

~~I guess Nord is updating the auth certificates on their servers. Until all the servers are updated it may just be luck of the draw whether the one you connect to has been updated.~~

If that is the issue then it should resolve itself once their remote servers and the configs being served from their api (api.nordvpn.com) are in sync again. And if you can't wait for that then maybe people who've connected successfully could check their logs and see which server they connected to. I got onto fr949.nordvpn.com, so if you set NORDVPN_SERVER=fr949.nordvpn.com it should work for you too.

Look for a line that looks something like:
2024-04-02 15:51:46 VERIFY OK: depth=0, CN=fr949.nordvpn.com

A commenter on the issue for this tested the above out and it didn't fix the issue, they used the exact same server that I had success on and it didn't work for them 😬

0 replies

jmoore30 · 2024-04-02T21:15:32Z

jmoore30
Apr 2, 2024

I'm also having this issue with NordVPN and receiving the following error, even after trying multiple countries:
AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher)

This container has been working fine for over a year with no changes - any suggestions to troubleshoot? Thanks

0 replies

gchenfc · 2024-04-03T02:47:06Z

gchenfc
Apr 3, 2024

#2820 (#2820 (comment)) with fix in PR #2821

Hard-coding the server may work temporarily as not all the servers seem to have updated to the new cipher, but probably best to merge in the PR (build locally until it's updated on docker hub).

0 replies

Grumpher · 2024-04-03T03:10:36Z

Grumpher
Apr 3, 2024

Mine was working up until yesterday and has now picked up this issue today in Aus, guess all i can do is wait or force it to go to a different country

0 replies

adamtmitchell · 2024-04-03T03:24:04Z

adamtmitchell
Apr 3, 2024

My Nord connection started failing about 16 hours ago. I've manually changed the default.ovpn config to AES-256-GCM and confirmed in the logs that it is using it, and have also tried changing server regions (i'm in AU and have tried US), however the error (see below) seems to imply that it doesn't like my service credentials. I've double checked that nothing has changed on Nord's end though... so i'm not sure what the issue is.

2024-04-03 03:17:28 AUTH: Received control message: AUTH_FAILED
2024-04-03 03:17:27 SENT CONTROL [us9870.nordvpn.com]: 'PUSH_REQUEST' (status=1)
2024-04-03 03:17:28 SIGTERM[soft,auth-failure] received, process exiting

0 replies

ilike2burnthing · 2024-04-03T08:54:05Z

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NordVPN connection fail: no shared cipher #2819

{{title}}

Replies: 8 comments 6 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

NordVPN connection fail: no shared cipher #2819

Replies: 8 comments · 6 replies

dpellegr Mar 29, 2024 Author

dpellegr Mar 30, 2024 Author

Replies: 8 comments 6 replies

dpellegr
Mar 29, 2024
Author

dpellegr Mar 30, 2024
Author