OPTIONS ERROR: failed to negotiate cipher with server.

[squiz-git]

Trying to start container using a supported provider however keep facing this issue. I can't directly access the container as it instantly stops.

2024-05-17 15:46:31 OPTIONS ERROR: failed to negotiate cipher with server.  Add the server's cipher ('BF-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM') if you want to connect to this server.

2024-05-17 15:46:31 ERROR: Failed to apply push options

2024-05-17 15:46:31 Failed to open tun/tap interface

2024-05-17 15:46:31 SIGTERM received, sending exit notification to peer

2024-05-17 15:46:36 SENT CONTROL [vpn]: 'PUSH_REQUEST' (status=1)

2024-05-17 15:46:36 SIGTERM[soft,exit-with-notification] received, process exiting

Please let me know if I need to provide any additional information that could be helpful.

[pkishino]

Outdated config files.. would need to be updated on our repo. Until then follow the steps in our wiki to use custom provider files and download them yourself from the provider

[edgd1er]

some story as other providers, deprecated cipher since 2.5 version: Removal of BF-CBC support in default configuration.
This container downloads the config file when not present.

Several solutions, long term and short term:

• long term: contact the VYPRVPN to ask for an update of their files.
• mid term: send a merge request with a modification of vyprvpn/configure-openvpn.sh to add the deprecated ciphers
• short term: download the config files, edit them, and mount the directory as indicated in the doc use_your_own_config_without_building_the_image

An explanation and a way to add the cipher here under: https://github.com/OpenVPN/openvpn/blob/master/Changes.rst
not sure this is still possible.

    By default OpenVPN 2.5 will only accept AES-256-GCM and AES-128-GCM as data ciphers. OpenVPN 2.4 allows AES-256-GCM,AES-128-GCM and BF-CBC when no --cipher and --ncp-ciphers options are present. Accepting BF-CBC can be enabled by adding

        data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC

    and when you need to support very old peers also

        data-ciphers-fallback BF-CBC

    To offer backwards compatibility with older configs an explicit

        cipher BF-CBC

    in the configuration will be automatically translated into adding BF-CBC to the data-ciphers option and setting data-ciphers-fallback to BF-CBC (as in the example commands above). We strongly recommend to switching away from BF-CBC to a more secure cipher.