# Random VPN drops due to "AEAD Decrypt error"

**URL:** <https://forum.pritunl.com/t/random-vpn-drops-due-to-aead-decrypt-error/2289>\
**Category:** Pritunl VPN\
**Tags:** pritunl, pritunl-client\
**Created:** [August 16, 2024, 10:37pm UTC](https://forum.pritunl.com/t/random-vpn-drops-due-to-aead-decrypt-error/2289 "2024-08-16T22:37:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DVL](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/d/f475e1/32.png) [@DVL](https://forum.pritunl.com/u/DVL)\
**Post date:** [August 16, 2024, 10:37pm UTC](https://forum.pritunl.com/t/random-vpn-drops-due-to-aead-decrypt-error/2289/1 "2024-08-16T22:37:42Z")

</div>

This spring we moved our Pritunl setup from Ubuntu to Oracle Linux (as this is recommended) and since we have been having problems with sporadic VPN drops. When this happens, the client logs has this error:

```auto
2024-08-14 11:26:43 AEAD Decrypt error: bad packet ID (may be a replay): [#26658] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

```

And in the server logs, we see similar errors:

```auto
2024-08-14 11:26:45 us=465216 AEAD Decrypt error: cipher final failed

```

This is seen across four servers in different AWS regions and with clients from several continents, so it doesn’t seem like a specific network issue for one client/server.

First, I’m seeking guidance on how to approach debugging this issue.

Secondly, I’m curious whether the move from Ubuntu to Oracle Linux could be related, e.g., the introduction of SELinux as part of this move.

Thanks!

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [August 23, 2024, 4:26am UTC](https://forum.pritunl.com/t/random-vpn-drops-due-to-aead-decrypt-error/2289/2 "2024-08-23T04:26:38Z")

</div>

Check the server output when starting the server and verify the OpenVPN version is the updated version from the `pritunl-openvpn` package. The [**connection fix**](https://docs.pritunl.com/docs/rhel-connection-fix) documentation has information on installing the package.

---

<div class="post-metadata">

**Author:** ![DVL](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/d/f475e1/32.png) [@DVL](https://forum.pritunl.com/u/DVL)\
**Post date:** [August 23, 2024, 5:02pm UTC](https://forum.pritunl.com/t/random-vpn-drops-due-to-aead-decrypt-error/2289/3 "2024-08-23T17:02:23Z")

</div>

Hi Zach,

It looks like the correct package is already installed:

```auto
sudo yum --allowerasing install pritunl-openvpn
Last metadata expiration check: 2:55:31 ago on Fri 23 Aug 2024 02:02:00 PM GMT.
Package pritunl-openvpn-2.6.8-1.el8.oraclelinux.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!

```

Startup output:

```auto
2024-08-23 16:54:32 OpenVPN 2.6.8 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]

```

I also tried updating all system software (including kernel) to the latest, but i still see the same issue:

```auto
2024-08-23 10:25:46 AEAD Decrypt error: bad packet ID (may be a replay): [#263634] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

```

For reference, the client version I’m using is `Pritunl Client v1.3.3883.60` and it is on `macOS 14.6.1`