Dear Maintainer,

Since upgrading to Debian Trixie (testing/stable) and OpenVPN 2.6, the OpenVPN client managed by NetworkManager (NM) fails to connect to older OpenVPN servers (e.g., VPN Gate servers).

The root cause is that the NM OpenVPN plugin ignores crucial compatibility options required by OpenVPN 2.6 for negotiating with older servers, even when these options are manually added to the `.nmconnection` file.

This seems highly related to **Bug #1107240** (GUI import/edit drops crucial "data-ciphers" option), but affects configurations across KDE/Plasma via manual file editing as well.

## Observed Errors and Problem Summary

The connection is blocked by two simultaneous errors, indicating that required compatibility settings are not passed from NM to the OpenVPN process:

1.  **Cipher Negotiation Failure:**
    ```
    OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-128-CBC') to --data-ciphers
    ```

2.  **Tunnel/Compression Setup Failure:**
    ```
    ERROR: Failed to apply push options
    Failed to open tun/tap interface
    ```

## Attempts and Effective Solution

**What exactly did you do (or not do) that was effective (or ineffective)?**

* **Ineffective:** Manual editing of the `.nmconnection` file (adding `data-ciphers`, `data-ciphers-fallback`, `push-peer-info`, and `allow-compression yes` to various sections like `[vpn]` and `[openvpn]`) was completely ignored by the NetworkManager plugin.

**What was the outcome of this action?**

* The connection consistently failed with the errors shown above.

**What outcome did you expect instead?**

* I expected NM to honor the configuration options added to the `.nmconnection` file and successfully connect.

**Effective Solution (Bypassing NetworkManager):**

The VPN connects and works flawlessly when run directly from the console with the required compatibility options, confirming that the issue is solely in the NetworkManager plugin's parsing/passing mechanism:

```bash
sudo openvpn --config /path/to/file.ovpn --data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-128-CBC --push-peer-info --allow-compression yes

Hi Dawid,

it's probably best if you raise this issue upstream at
https://gitlab.gnome.org/GNOME/NetworkManager-openvpn

The Debian package does not ship any patches which would change its
behaviour regarding data-ciphers and push-peer-info.

Please report back once you have an upstream reference so I can update
the Debian bug report accordingly.

Regards
Michael

Hi

Using Debian 13 myself.

Editing the NMconnection file and adding
"data-ciphers=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-128-CBC"
does solve the connection issue however....

The real bug seems to relate to the fact NetworkManager must be
restarted before trying the connection, preferably stopped then
restarted after modifying the file.

In some cases the connection vanishes from NM however it still appears
in the systemconnections directory. Go figure?

The import option is a bit of a mess, it misses the whole section for
TLS and adds the port to the file name which then seems to corrupt the
import.  My solution is to create a basic OpenVPN connnection, Stop NM,
edit the file, start NM and pray!

A template for import would be useful as I can't fathom the file
structure or fields required.

Example of one of my working configs.

[connection]

id=us-la2-smart.serverlocation.co
uuid=bd3e845a-f09e-4a31-b94e-108d72dc6d39
type=vpn

[vpn]
auth=SHA256
ca=/VPN/serverlocation.crt
cipher=AES-256-CBC
data-ciphers=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
connection-type=password
dev-type=tun
float=no
mssfix=no
ns-cert-type=server
password-flags=1
port=1194
proto-tcp=yes
remote=us-la2-smart.serverlocation.co
remote-random=no
ta=/VPN/tls.crt
ta-dir=1
tun-ipv6=no
tunnel-mtu=1500
username=harryharry
service-type=org.freedesktop.NetworkManager.openvpn

[ipv4]
method=auto

[ipv6]