Tls-crypt-v2 issue

[m1si0]

Hello,
Could you please update the OpenVPN core/library used by VPN Client Pro to version 2.7.6 or newer?

After updating my Asuswrt-Merlin router to firmware 3004.388.12, I enabled “Encrypt Channel V2” (tls-crypt-v2) on my OpenVPN server. The VPN profile connects successfully in VPN Client Pro, but Internet traffic and access to LAN services do not work correctly. For example, Gmail does not synchronize, Home Assistant cannot be reached, and Qfile either hangs or loads extremely slowly.

The exact same newly generated tls-crypt-v2 profile works properly on my Windows PC after updating the OpenVPN client from version 2.7.5 to 2.7.6. It also works correctly in OpenVPN for Android on the same phone.

This strongly suggests that the OpenVPN version embedded in VPN Client Pro has a compatibility issue with tls-crypt-v2 / OpenVPN 2.7.5+ server configurations. The connection itself completes, but traffic through the tunnel is not handled correctly.

Could you please investigate and update the embedded OpenVPN engine to 2.7.6 or later?

[admin]

Hello,
OpenVPN version 2.7.6 has already been implemented and is currently undergoing internal testing. If all goes well, it will be released to the beta channel next week.
However, OpenVPN version 2.7.5 doesn't appear to have compatibility issues with the tls-crypt-v2 option.
Have you checked your VPN logs?

[m1si0]

Hello,

I checked the VPN log. The profile connects, but the tunnel does not work correctly. The log contains the following messages:

OpenVPN 2.7.5
AUTH_FAILED
Initialization Sequence Completed
read UDPv4 [EMSGSIZE Path-MTU=1492]: Message too long
AEAD Decrypt error: bad packet ID (may be a replay)

The same tls-crypt-v2 profile works correctly on Windows with OpenVPN 2.7.6 and in OpenVPN for Android on the same phone.

Therefore, could you please investigate whether VPN Client Pro has an OpenVPN 2.7.5 compatibility issue with tls-crypt-v2, packet size/MTU handling, or AEAD packet replay protection?

[admin]

Please, can you add the "verb 4" to the advanced options and resend the log?
The log will be too long for a screenshot, but you can easily export it by tapping the icon in the top right and then the "Export log" option.

[m1si0]

My file config

Code: Select all

# Config generated by Asuswrt-Merlin 388.12, requires OpenVPN 2.5.0 or newer. Update by m1si0_niteopl

client
dev tun
proto udp
remote XX.XXX.XX.XXX 1194
resolv-retry infinite
nobind
float

# --- Bezpieczeństwo i Szyfrowanie ---
data-ciphers AES-256-GCM:AES-128-GCM
remote-cert-tls server
tls-version-min 1.2

# --- Wydajność i Stabilność ---
sndbuf 0
rcvbuf 0
keepalive 15 60
mssfix 1360

# --- Prywatność i DNS ---
auth-user-pass
dhcp-option DNS 1.1.1.1

# --- Klucze i Certyfikaty ---
<ca>
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

</ca>
<cert>
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

</cert>
<key>
-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----

</key>
<tls-crypt-v2>
-----BEGIN OpenVPN tls-crypt-v2 client key-----

-----END OpenVPN tls-crypt-v2 client key-----
</tls-crypt-v2>

Code: Select all

2026-08-25 08:38:35 VpnClientPro-google-api27-release-1.02.48 (30010248)
2026-08-25 08:38:35 WakeLock acquired
2026-08-25 08:38:35 Connecting request by user
2026-08-25 08:38:35 Note: --cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers. E.g. --data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC
2026-08-25 08:38:35 Current Parameter Settings:
2026-08-25 08:38:35   config = '/data/user/0/it.colucciweb.vpnclientpro/files/temp/964a2b48-9c74-4b0b-8666-08d828f3c90e.conf'
2026-08-25 08:38:35   mode = 0
2026-08-25 08:38:35   persist_config = DISABLED
2026-08-25 08:38:35   persist_mode = 1
2026-08-25 08:38:35   show_ciphers = DISABLED
2026-08-25 08:38:35   show_digests = DISABLED
2026-08-25 08:38:35   show_engines = DISABLED
2026-08-25 08:38:35   genkey = DISABLED
2026-08-25 08:38:35   genkey_filename = '[UNDEF]'
2026-08-25 08:38:35   key_pass_file = '[UNDEF]'
2026-08-25 08:38:35   show_tls_ciphers = DISABLED
2026-08-25 08:38:35   connect_retry_max = 0
2026-08-25 08:38:35 Connection profiles [0]:
2026-08-25 08:38:35   proto = udp
2026-08-25 08:38:35   Local Sockets:
2026-08-25 08:38:35     [(null)]:1194-udp
2026-08-25 08:38:35   remote = 'niteopl.ddns.net'
2026-08-25 08:38:35   remote_port = '1194'
2026-08-25 08:38:35   remote_float = ENABLED
2026-08-25 08:38:35   bind_defined = DISABLED
2026-08-25 08:38:35   bind_local = DISABLED
2026-08-25 08:38:35   bind_ipv6_only = DISABLED
2026-08-25 08:38:35   connect_retry_seconds = 5
2026-08-25 08:38:35   connect_timeout = 120
2026-08-25 08:38:35   xormethod = 0
2026-08-25 08:38:35   xormask = ''
2026-08-25 08:38:35   xormasklen = 0
2026-08-25 08:38:35   socks_proxy_server = '[UNDEF]'
2026-08-25 08:38:35   socks_proxy_port = '[UNDEF]'
2026-08-25 08:38:35   tun_mtu = 1500
2026-08-25 08:38:35   tun_mtu_defined = ENABLED
2026-08-25 08:38:35   link_mtu = 1500
2026-08-25 08:38:35   link_mtu_defined = DISABLED
2026-08-25 08:38:35   tun_mtu_extra = 0
2026-08-25 08:38:35   tun_mtu_extra_defined = DISABLED
2026-08-25 08:38:35   tls_mtu = 1250
2026-08-25 08:38:35   mtu_discover_type = -1
2026-08-25 08:38:35   fragment = 0
2026-08-25 08:38:35   mssfix = 1492
2026-08-25 08:38:35   mssfix_encap = ENABLED
2026-08-25 08:38:35   mssfix_fixed = DISABLED
2026-08-25 08:38:35   explicit_exit_notification = 0
2026-08-25 08:38:35   tls_auth_file = '[UNDEF]'
2026-08-25 08:38:35   key_direction = not set
2026-08-25 08:38:35   tls_crypt_file = '[UNDEF]'
2026-08-25 08:38:35   tls_crypt_v2_file = '[INLINE]'
2026-08-25 08:38:35 Connection profiles END
2026-08-25 08:38:35   remote_random = DISABLED
2026-08-25 08:38:35   ipchange = '[UNDEF]'
2026-08-25 08:38:35   dev = 'tun'
2026-08-25 08:38:35   dev_type = '[UNDEF]'
2026-08-25 08:38:35   dev_node = '[UNDEF]'
2026-08-25 08:38:35   lladdr = '[UNDEF]'
2026-08-25 08:38:35   topology = 1
2026-08-25 08:38:35   ifconfig_local = '[UNDEF]'
2026-08-25 08:38:35   ifconfig_remote_netmask = '[UNDEF]'
2026-08-25 08:38:35   ifconfig_noexec = DISABLED
2026-08-25 08:38:35   ifconfig_nowarn = DISABLED
2026-08-25 08:38:35   ifconfig_ipv6_local = '[UNDEF]'
2026-08-25 08:38:35   ifconfig_ipv6_netbits = 0
2026-08-25 08:38:35   ifconfig_ipv6_remote = '[UNDEF]'
2026-08-25 08:38:35   shaper = 0
2026-08-25 08:38:35   mtu_test = 0
2026-08-25 08:38:35   mlock = DISABLED
2026-08-25 08:38:35   keepalive_ping = 15
2026-08-25 08:38:35   keepalive_timeout = 60
2026-08-25 08:38:35   inactivity_timeout = 0
2026-08-25 08:38:35   session_timeout = 0
2026-08-25 08:38:35   inactivity_minimum_bytes = 0
2026-08-25 08:38:35   ping_send_timeout = 15
2026-08-25 08:38:35   ping_rec_timeout = 60
2026-08-25 08:38:35   ping_rec_timeout_action = 2
2026-08-25 08:38:35   ping_timer_remote = DISABLED
2026-08-25 08:38:35   remap_sigusr1 = 0
2026-08-25 08:38:35   persist_tun = DISABLED
2026-08-25 08:38:35   persist_local_ip = DISABLED
2026-08-25 08:38:35   persist_remote_ip = DISABLED
2026-08-25 08:38:35   passtos = DISABLED
2026-08-25 08:38:35   resolve_retry_seconds = 1000000000
2026-08-25 08:38:35   resolve_in_advance = DISABLED
2026-08-25 08:38:35   username = '[UNDEF]'
2026-08-25 08:38:35   groupname = '[UNDEF]'
2026-08-25 08:38:35   chroot_dir = '[UNDEF]'
2026-08-25 08:38:35   cd_dir = '[UNDEF]'
2026-08-25 08:38:35   writepid = '[UNDEF]'
2026-08-25 08:38:35   up_script = '[UNDEF]'
2026-08-25 08:38:35   down_script = '[UNDEF]'
2026-08-25 08:38:35   down_pre = DISABLED
2026-08-25 08:38:35   up_restart = DISABLED
2026-08-25 08:38:35   up_delay = DISABLED
2026-08-25 08:38:35   daemon = DISABLED
2026-08-25 08:38:35   log = DISABLED
2026-08-25 08:38:35   suppress_timestamps = ENABLED
2026-08-25 08:38:35   machine_readable_output = DISABLED
2026-08-25 08:38:35   nice = 0
2026-08-25 08:38:35   verbosity = 4
2026-08-25 08:38:35   mute = 0
2026-08-25 08:38:35   gremlin = 0
2026-08-25 08:38:35   status_file = '[UNDEF]'
2026-08-25 08:38:35   status_file_version = 1
2026-08-25 08:38:35   status_file_update_freq = 60
2026-08-25 08:38:35   occ = ENABLED
2026-08-25 08:38:35   rcvbuf = 0
2026-08-25 08:38:35   sndbuf = 0
2026-08-25 08:38:35   mark = 0
2026-08-25 08:38:35   sockflags = 0
2026-08-25 08:38:35   comp.alg = 0
2026-08-25 08:38:35   comp.flags = 24
2026-08-25 08:38:35   route_script = '[UNDEF]'
2026-08-25 08:38:35   route_default_gateway = '[UNDEF]'
2026-08-25 08:38:35   route_default_metric = 0
2026-08-25 08:38:35   route_default_table_id = 0
2026-08-25 08:38:35   route_noexec = DISABLED
2026-08-25 08:38:35   route_delay = 0
2026-08-25 08:38:35   route_delay_window = 30
2026-08-25 08:38:35   route_delay_defined = DISABLED
2026-08-25 08:38:35   route_nopull = DISABLED
2026-08-25 08:38:35   route_gateway_via_dhcp = DISABLED
2026-08-25 08:38:35   allow_pull_fqdn = DISABLED
2026-08-25 08:38:35   shared_secret_file = '[UNDEF]'
2026-08-25 08:38:35   key_direction = not set
2026-08-25 08:38:35   ciphername = 'BF-CBC'
2026-08-25 08:38:35   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
2026-08-25 08:38:35   authname = 'SHA1'
2026-08-25 08:38:35   engine = DISABLED
2026-08-25 08:38:35   mute_replay_warnings = DISABLED
2026-08-25 08:38:35   replay_window = 64
2026-08-25 08:38:35   replay_time = 15
2026-08-25 08:38:35   packet_id_file = '[UNDEF]'
2026-08-25 08:38:35   test_crypto = DISABLED
2026-08-25 08:38:35   tls_server = DISABLED
2026-08-25 08:38:35   tls_client = ENABLED
2026-08-25 08:38:35   ca_file = '[INLINE]'
2026-08-25 08:38:35   ca_path = '[UNDEF]'
2026-08-25 08:38:35   dh_file = '[UNDEF]'
2026-08-25 08:38:35   cert_file = '[INLINE]'
2026-08-25 08:38:35   extra_certs_file = '[UNDEF]'
2026-08-25 08:38:35   priv_key_file = '[INLINE]'
2026-08-25 08:38:35   pkcs12_file = '[UNDEF]'
2026-08-25 08:38:35   cipher_list = '[UNDEF]'
2026-08-25 08:38:35   cipher_list_tls13 = '[UNDEF]'
2026-08-25 08:38:35   tls_cert_profile = '[UNDEF]'
2026-08-25 08:38:35   tls_verify = '[UNDEF]'
2026-08-25 08:38:35   tls_export_peer_cert_dir = '[UNDEF]'
2026-08-25 08:38:35   verify_x509_type = 0
2026-08-25 08:38:35   verify_x509_name = '[UNDEF]'
2026-08-25 08:38:35   crl_file = '[UNDEF]'
2026-08-25 08:38:35   ns_cert_type = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 65535
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_ku[i] = 0
2026-08-25 08:38:35   remote_cert_eku = 'TLS Web Server Authentication'
2026-08-25 08:38:35   ssl_flags = 192
2026-08-25 08:38:35   tls_timeout = 2
2026-08-25 08:38:35   renegotiate_bytes = -1
2026-08-25 08:38:35   renegotiate_packets = 0
2026-08-25 08:38:35   renegotiate_seconds = 3600
2026-08-25 08:38:35   handshake_window = 60
2026-08-25 08:38:35   transition_window = 3600
2026-08-25 08:38:35   single_session = DISABLED
2026-08-25 08:38:35   push_peer_info = DISABLED
2026-08-25 08:38:35   tls_exit = DISABLED
2026-08-25 08:38:35   tls_crypt_v2_metadata = '[UNDEF]'
2026-08-25 08:38:35   server_network = 0.0.0.0
2026-08-25 08:38:35   server_netmask = 0.0.0.0
2026-08-25 08:38:35   server_network_ipv6 = ::
2026-08-25 08:38:35   server_netbits_ipv6 = 0
2026-08-25 08:38:35   server_bridge_ip = 0.0.0.0
2026-08-25 08:38:35   server_bridge_netmask = 0.0.0.0
2026-08-25 08:38:35   server_bridge_pool_start = 0.0.0.0
2026-08-25 08:38:35   server_bridge_pool_end = 0.0.0.0
2026-08-25 08:38:35   ifconfig_pool_defined = DISABLED
2026-08-25 08:38:35   ifconfig_pool_start = 0.0.0.0
2026-08-25 08:38:35   ifconfig_pool_end = 0.0.0.0
2026-08-25 08:38:35   ifconfig_pool_netmask = 0.0.0.0
2026-08-25 08:38:35   ifconfig_pool_persist_filename = '[UNDEF]'
2026-08-25 08:38:35   ifconfig_pool_persist_refresh_freq = 600
2026-08-25 08:38:35   ifconfig_ipv6_pool_defined = DISABLED
2026-08-25 08:38:35   ifconfig_ipv6_pool_base = ::
2026-08-25 08:38:35   ifconfig_ipv6_pool_netbits = 0
2026-08-25 08:38:35   n_bcast_buf = 256
2026-08-25 08:38:35   tcp_queue_limit = 64
2026-08-25 08:38:35   real_hash_size = 0
2026-08-25 08:38:35   virtual_hash_size = 0
2026-08-25 08:38:35   client_connect_script = '[UNDEF]'
2026-08-25 08:38:35   learn_address_script = '[UNDEF]'
2026-08-25 08:38:35   client_disconnect_script = '[UNDEF]'
2026-08-25 08:38:35   client_crresponse_script = '[UNDEF]'
2026-08-25 08:38:35   client_config_dir = '[UNDEF]'
2026-08-25 08:38:35   ccd_exclusive = DISABLED
2026-08-25 08:38:35   tmp_dir = '/data/user/0/it.colucciweb.vpnclientpro/files/temp'
2026-08-25 08:38:35   push_ifconfig_defined = DISABLED
2026-08-25 08:38:35   push_ifconfig_local = 0.0.0.0
2026-08-25 08:38:35   push_ifconfig_remote_netmask = 0.0.0.0
2026-08-25 08:38:35   push_ifconfig_ipv6_defined = DISABLED
2026-08-25 08:38:35   push_ifconfig_ipv6_local = ::/0
2026-08-25 08:38:35   push_ifconfig_ipv6_remote = ::
2026-08-25 08:38:35   enable_c2c = DISABLED
2026-08-25 08:38:35   duplicate_cn = DISABLED
2026-08-25 08:38:35   cf_max = 0
2026-08-25 08:38:35   cf_per = 0
2026-08-25 08:38:35   cf_initial_max = 100
2026-08-25 08:38:35   cf_initial_per = 10
2026-08-25 08:38:35   max_clients = 1024
2026-08-25 08:38:35   max_routes_per_client = 256
2026-08-25 08:38:35   auth_user_pass_verify_script = '[UNDEF]'
2026-08-25 08:38:35   auth_user_pass_verify_script_via_file = DISABLED
2026-08-25 08:38:35   auth_token_generate = DISABLED
2026-08-25 08:38:35   force_key_material_export = DISABLED
2026-08-25 08:38:35   auth_token_lifetime = 0
2026-08-25 08:38:35   auth_token_secret_file = '[UNDEF]'
2026-08-25 08:38:35   port_share_host = '[UNDEF]'
2026-08-25 08:38:35   port_share_port = '[UNDEF]'
2026-08-25 08:38:35   vlan_tagging = DISABLED
2026-08-25 08:38:35   vlan_accept = all
2026-08-25 08:38:35   vlan_pvid = 1
2026-08-25 08:38:35   client = ENABLED
2026-08-25 08:38:35   pull = ENABLED
2026-08-25 08:38:35   auth_user_pass_file = 'stdin'
2026-08-25 08:38:35 OpenVPN 2.7.5 android-arm64-v8a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-08-25 08:38:35 library versions: OpenSSL 3.5.7 9 Jun 2026, LZO 2.10
2026-08-25 08:38:35 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2026-08-25 08:38:35 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2026-08-25 08:38:35 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2026-08-25 08:38:35 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2026-08-25 08:38:35 Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 tun_max_mtu:0 headroom:126 payload:1600 tailroom:126 ET:0 ]
2026-08-25 08:38:35 Data Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
2026-08-25 08:38:35 TCP/UDP: Preserving recently used remote address: [AF_INET]XX.XXX.XX.XXX:1194
2026-08-25 08:38:35 Socket Buffers: R=[229376->229376] S=[229376->229376]
2026-08-25 08:38:35 UDPv4 link local: (not bound)
2026-08-25 08:38:35 UDPv4 link remote: [AF_INET]XX.XXX.XX.XXX:1194
2026-08-25 08:38:35 TLS: Initial packet from [AF_INET]XX.XXX.XX.XXX:1194, sid=99066cf4 fe177021
2026-08-25 08:38:35 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, OU=Home/Office, CN=RT-AX88U, emailAddress=me@asusrouter.lan
2026-08-25 08:38:35 VERIFY KU OK
2026-08-25 08:38:35 Validating certificate extended key usage
2026-08-25 08:38:35 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2026-08-25 08:38:35 VERIFY EKU OK
2026-08-25 08:38:35 VERIFY OK: depth=0, C=TW, ST=TW, L=Taipei, O=ASUS, OU=Home/Office, CN=RT-AX88U, emailAddress=me@asusrouter.lan
2026-08-25 08:38:35 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 1024 bits RSA, signature: RSA-SHA256, peer temporary key: 253 bits X25519, peer signing digest/type: rsa_pss_rsae_sha256 RSASSA-PSS, key agreement: x25519
2026-08-25 08:38:35 [RT-AX88U] Peer Connection Initiated with [AF_INET]XX.XXX.XX.XXX:1194
2026-08-25 08:38:35 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
2026-08-25 08:38:35 TLS: tls_multi_process: initial untrusted session promoted to trusted
2026-08-25 08:38:35 PUSH: Received control message: 'PUSH_REPLY,route 192.168.55.0 255.255.255.0 vpn_gateway 500,dhcp-option DNS 192.168.55.1,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 60,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt aead-epoch,tun-mtu 1500'
2026-08-25 08:38:35 OPTIONS IMPORT: --ifconfig/up options modified
2026-08-25 08:38:35 OPTIONS IMPORT: route options modified
2026-08-25 08:38:35 OPTIONS IMPORT: route-related options modified
2026-08-25 08:38:35 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2026-08-25 08:38:35 OPTIONS IMPORT: tun-mtu set to 1500
2026-08-25 08:38:35 do_ifconfig, ipv4=1, ipv6=0
2026-08-25 08:38:36 TUN/TAP device  opened
2026-08-25 08:38:36 tun/tap device [] opened
2026-08-25 08:38:36 Data Channel MTU parms [ mss_fix:1400 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
2026-08-25 08:38:36 Outgoing dynamic tls-crypt: Cipher 'AES-256-CTR' initialized with 256 bit key
2026-08-25 08:38:36 Outgoing dynamic tls-crypt: Using 256 bit message hash 'SHA256' for HMAC authentication
2026-08-25 08:38:36 Incoming dynamic tls-crypt: Cipher 'AES-256-CTR' initialized with 256 bit key
2026-08-25 08:38:36 Incoming dynamic tls-crypt: Using 256 bit message hash 'SHA256' for HMAC authentication
2026-08-25 08:38:36 Outgoing Epoch Data key 1: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 1: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 2: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 3: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 4: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 5: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 6: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 7: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 8: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 9: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 10: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 11: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 12: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 13: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 14: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 15: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 16: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Incoming Epoch Data key 17: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-08-25 08:38:36 Initialization Sequence Completed
2026-08-25 08:38:36 Data Channel: cipher 'AES-256-GCM', peer-id: 0
2026-08-25 08:38:36 Timers: ping 15, ping-restart 60
2026-08-25 08:38:36 Protocol options: protocol-flags cc-exit tls-ekm dyn-tls-crypt aead-epoch
2026-08-25 08:38:36 read UDPv4 [EMSGSIZE Path-MTU=1492]: Message too long (fd=112,code=90)
2026-08-25 08:39:28 PID_ERR replay-window backtrack occurred [1] [SSL-0] [0_000000000000000000000_000_000000_0000000000000001_4__5___55___] 0:260 0:259 t=1787639968[0] r=[0,64,15,1,1] sl=[60,64,64,528]

[admin]

The configuration seems correct.
I've done some testing, and everything seems to work correctly with both OpenVPN versions 2.7.5 and 2.7.6.
The problem is likely related to connectivity and packet size.
You can try adding the "fragment 1400" option, but it must be added on both the server and all clients.
For VPN Client Pro, you can change the "Set max UDP fragment size" option in the remote servers section.