If we don’t specify cipher the following set of commands leads to openvpn@vtun0.service restart loop:
run generate pki openvpn shared-secret install ovpn_test set interfaces openvpn vtun0 mode 'site-to-site' set interfaces openvpn vtun0 local-address '192.0.2.60' set interfaces openvpn vtun0 remote-address '192.0.2.61' set interfaces openvpn vtun0 shared-secret-key 'ovpn_test' commit
If we specify cipher the openvpn service starts ok:
set interfaces openvpn vtun0 encryption cipher aes256
journal:
Feb 21 15:30:28 vyos vyos-configd[815]: scripts_called: ['interfaces_openvpn_vtun0'] Feb 21 15:30:28 vyos vyos-configd[815]: Sending reply: SUCCESS with output Feb 21 15:30:28 vyos systemd[1]: opt-vyatta-config-tmp-new_config_56690.mount: Deactivated successfully. Feb 21 15:30:29 vyos openvpn-vtun0[57707]: Cipher BF-CBC not supported Feb 21 15:30:29 vyos openvpn-vtun0[57707]: Exiting due to fatal error Feb 21 15:30:29 vyos systemd[1]: openvpn@vtun0.service: Main process exited, code=exited, status=1/FAILURE Feb 21 15:30:29 vyos systemd[1]: openvpn@vtun0.service: Failed with result 'exit-code'. Feb 21 15:30:30 vyos commit[57894]: Successful change to active configuration by user vyos on /dev/pts/0 Feb 21 15:30:34 vyos systemd[1]: openvpn@vtun0.service: Scheduled restart job, restart counter is at 104. Feb 21 15:30:34 vyos systemd[1]: Stopped OpenVPN connection to vtun0. Feb 21 15:30:34 vyos systemd[1]: Starting OpenVPN connection to vtun0... Feb 21 15:30:34 vyos openvpn-vtun0[57897]: DEPRECATED OPTION: The option --secret is deprecated. Feb 21 15:30:34 vyos openvpn-vtun0[57897]: DEPRECATION: No tls-client or tls-server option in configuration detected. OpenVPN 2.7 will remove the functionality to run a VPN without TLS. See the examples section in the manual page for examples of a similar quick setup with peer-fingerprint. Feb 21 15:30:34 vyos openvpn-vtun0[57897]: WARNING: file '/run/openvpn/vtun0_shared.key' is group or others accessible Feb 21 15:30:34 vyos openvpn-vtun0[57897]: OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] Feb 21 15:30:34 vyos openvpn-vtun0[57897]: library versions: OpenSSL 3.0.18 30 Sep 2025, LZO 2.10 Feb 21 15:30:34 vyos openvpn-vtun0[57897]: DCO version: N/A Feb 21 15:30:34 vyos openvpn-vtun0[57897]: Cipher BF-CBC not supported Feb 21 15:30:34 vyos openvpn-vtun0[57897]: Exiting due to fatal error Feb 21 15:30:34 vyos systemd[1]: Started OpenVPN connection to vtun0. Feb 21 15:30:34 vyos systemd[1]: openvpn@vtun0.service: Main process exited, code=exited, status=1/FAILURE Feb 21 15:30:34 vyos systemd[1]: openvpn@vtun0.service: Failed with result 'exit-code'. Feb 21 15:30:39 vyos systemd[1]: openvpn@vtun0.service: Scheduled restart job, restart counter is at 105.