5

I just installed openvpn on a remote CentOS 7 server using the instructions in this tutorial.

The only change I made to the tutorial was to use @GarethTheRed's instructions for configuring firewalld instead of iptables, as described in Step 4 of the tutorial.

The problem is that the tutorial ends with a line of client code that causes the terminal to fail to return a command prompt (see below). How can I successfully connect via OpenVPN to my remote CentOS 7 server from my local CentOS 7 devbox?

Here are the connection steps I have tried so far:

At the end of Step 6 of the tutorial, I successfully used yum install openvpn on my devbox before typing sudo openvpn --config /path/to/client.ovpn.

The problem is that sudo openvpn --config /path/to/client.ovpn results in the terminal locking up after printing Initialization Sequence Completed.

The complete output is:

[root@localhost ~]# openvpn --config /etc/openvpn/client.ovpn
Wed Feb 11 16:46:06 2015 OpenVPN 2.3.6 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec  2 2014
Wed Feb 11 16:46:06 2015 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Wed Feb 11 16:46:06 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Feb 11 16:46:06 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Feb 11 16:46:06 2015 UDPv4 link local: [undef]
Wed Feb 11 16:46:06 2015 UDPv4 link remote: [AF_INET]192.96.215.22:1194
Wed Feb 11 16:46:06 2015 TLS: Initial packet from [AF_INET]192.96.215.22:1194, sid=1f320288 ab1f20d3
Wed Feb 11 16:46:07 2015 VERIFY OK: depth=1, C=US, ST=CA, L=SomeTown, O=Fort-Funston, OU=MyOrganizationalUnit, CN=serverdomain.com, name=server, emailAddress=me@somedomain.com
Wed Feb 11 16:46:07 2015 VERIFY OK: depth=0, C=US, ST=CA, L=SomeTown, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=server, emailAddress=me@somedomain.com
Wed Feb 11 16:46:08 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 11 16:46:08 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 11 16:46:08 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 11 16:46:08 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 11 16:46:08 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 11 16:46:08 2015 [server] Peer Connection Initiated with [AF_INET]192.96.215.22:1194
Wed Feb 11 16:46:10 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Feb 11 16:46:10 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Feb 11 16:46:10 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Feb 11 16:46:10 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 11 16:46:10 2015 OPTIONS IMPORT: route options modified
Wed Feb 11 16:46:10 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Feb 11 16:46:10 2015 ROUTE_GATEWAY 10.0.0.1/255.255.255.0 IFACE=p4p1 HWADDR=14:fe:b5:aa:57:60
Wed Feb 11 16:46:10 2015 TUN/TAP device tun0 opened
Wed Feb 11 16:46:10 2015 TUN/TAP TX queue length set to 100
Wed Feb 11 16:46:10 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 11 16:46:10 2015 /usr/sbin/ip link set dev tun0 up mtu 1500
Wed Feb 11 16:46:10 2015 /usr/sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed Feb 11 16:46:10 2015 /usr/sbin/ip route add 192.96.215.22/32 via 10.0.0.1
Wed Feb 11 16:46:10 2015 /usr/sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Wed Feb 11 16:46:10 2015 /usr/sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Wed Feb 11 16:46:10 2015 /usr/sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Wed Feb 11 16:46:10 2015 Initialization Sequence Completed  

At the end of this output, there is just a cursor, but no command prompt. Typing in the cursor or hitting return has no effect besides printing what you type on the terminal screen.

I read this other posting which describes a similar error and states that the problem is in the DNS configuration, but I followed the tutorial's DNS config instructions exactly. The server also handles requests for mydomain.com served up by httpd. The domain registrar has been pointing requests for mydomain.com to the ip of the server since long before adding OpenVPN. Would this cause some kind of conflict? How can I get the connection to complete?

7

Try starting the client with the --daemon option:

openvpn --daemon

From openvpn's man page:

--daemon [progname]
  Become a daemon after all initialization functions are completed

To interact with openvpn once it is a daemon, add the --management option to the command. This allows you to interact with it using telnet as described here.

Alternatively, open another terminal and just use that. This way, you can exit the running openvpn by pressing Ctl C in the original terminal.

If the client is a desktop system that uses Network Manager, then use the OpenVPN plugin to control it from there - no terminal needed.

  • @CodeMed - I've edited my answer... – garethTheRed Feb 12 '15 at 17:45
  • I am planning to use OpenVPN to 1.) allow the administrator to perform all admin functions that I currently perform with ssh and 2.) to allow users to interact with a private web application using their web browsers. I can put much of those requirements in other questions. Right now, I just want to get started so that I can research the possibilities with a working prototype. I'm telling you these details so you can help me define a working starting point. Just being able to access a terminal via OpenVPN would be great for now. Then I could shut down ssh altogether and do admin over OpenVPN – CodeMed Feb 12 '15 at 18:52
  • 1
    I ran openvpn --daemon and openvpn --daemon --management, but all I get is another command prompt after each of those commands. No error message. No success message. Nothing but another command prompt. Yes, I am trying to avoid opening the firewall for ssh. I want all ssh and http/s traffic to run inside the VPN tunnel, so that only two ports are open in the firewall, one for OpenVPN and the other for smtp. How can I check if I have a LAN IP address? This is all new to me. Thank you – CodeMed Feb 17 '15 at 1:11
  • 1
    I wish you guys did not use chat to solve the problem... I am stuck with this problem as of now. – lobi Sep 28 '15 at 22:05
  • 1
    @lobi. If we do not use chat, we get severely told off by the moderators :-) This is a question and answer site, not a question and discuss site and in order to keep it tidy, we are forced into chat every time the comments start to get a little long. In the perfect world, after discussing via chat, a relevant and concise answer should be posted; but as you can imagine, that doesn't always happen. – garethTheRed Sep 29 '15 at 6:26
-1

I encountered the same issue here and this is what worked for me:

# setenforce 0 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.