2

If I try to connect to my VPN using Network Manager, it fails, and /var/log/syslog reads:

Dec  4 17:43:25 zepto nm-openvpn[1696]: OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Dec  4 17:43:25 zepto nm-openvpn[1696]: library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Dec  4 17:43:25 zepto nm-openvpn[1696]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Dec  4 17:43:25 zepto nm-openvpn[1696]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Dec  4 17:43:25 zepto nm-openvpn[1696]: UDPv4 link local: [undef]
Dec  4 17:43:25 zepto nm-openvpn[1696]: UDPv4 link remote: [AF_INET]80.67.169.45:1194
Dec  4 17:44:06 zepto NetworkManager[484]: <warn> VPN connection 'VPN FDN' connect timeout exceeded.
Dec  4 17:44:06 zepto nm-openvpn[1696]: SIGTERM[hard,] received, process exiting
Dec  4 17:44:06 zepto NetworkManager[484]: nm-openvpn-Message: Terminated openvpn daemon with PID 1696.
Dec  4 17:44:11 zepto kernel: [  387.184894] perf interrupt took too long (2508 > 2500), lowering kernel.perf_event_max_sample_rate to 50000

But if I try to connect via the command-line, everything is fine:

openvpn /foo/vpn.ovpn
Sun Dec  4 17:45:30 2016 Option 'nobind' in /foo/vpn.ovpn:56 is ignored by previous <connection> blocks 
Sun Dec  4 17:45:30 2016 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Sun Dec  4 17:45:30 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Enter Auth Username: ***************************
Enter Auth Password: ***************************
Sun Dec  4 17:45:40 2016 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sun Dec  4 17:45:42 2016 Attempting to establish TCP connection with [AF_INET]80.67.169.57:1194 [nonblock]
Sun Dec  4 17:45:43 2016 TCP connection established with [AF_INET]80.67.169.57:1194
Sun Dec  4 17:45:43 2016 TCPv4_CLIENT link local: [undef]
Sun Dec  4 17:45:43 2016 TCPv4_CLIENT link remote: [AF_INET]80.67.169.57:1194
Sun Dec  4 17:45:43 2016 TLS: Initial packet from [AF_INET]80.67.169.57:1194, sid=e4a11fe9 9defe9fa
Sun Dec  4 17:45:43 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Dec  4 17:45:46 2016 VERIFY OK: depth=2, O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.org
Sun Dec  4 17:45:46 2016 VERIFY OK: depth=1, O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
Sun Dec  4 17:45:46 2016 VERIFY X509NAME OK: CN=*.fdn.fr
Sun Dec  4 17:45:46 2016 VERIFY OK: depth=0, CN=*.fdn.fr
Sun Dec  4 17:45:47 2016 WARNING: 'tun-ipv6' is present in remote config but missing in local config, remote='tun-ipv6'
Sun Dec  4 17:45:47 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Dec  4 17:45:47 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Dec  4 17:45:47 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Dec  4 17:45:47 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication                                             
Sun Dec  4 17:45:47 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA                                                 
Sun Dec  4 17:45:47 2016 [*.fdn.fr] Peer Connection Initiated with [AF_INET]80.67.169.57:1194                                                        
Sun Dec  4 17:45:49 2016 SENT CONTROL [*.fdn.fr]: 'PUSH_REQUEST' (status=1)
Sun Dec  4 17:45:50 2016 PUSH: Received control message: 'PUSH_REPLY,ifconfig-ipv6 2001:910:1370:ffff::1 2001:910:1301::1,tun-ipv6,dhcp-option DNS 80.67.169.12,dhcp-option DNS 2001:910:800::40,dhcp-option DNS 80.67.169.40,dhcp-option DNS 2001:910:800::12,ping 5,ping-restart 60,route-gateway 80.67.179.1,topology subnet,ifconfig 80.67.179.112 255.255.252.0'
Sun Dec  4 17:45:50 2016 OPTIONS IMPORT: timers and/or timeouts modified
Sun Dec  4 17:45:50 2016 OPTIONS IMPORT: --ifconfig/up options modified
Sun Dec  4 17:45:50 2016 OPTIONS IMPORT: route-related options modified
Sun Dec  4 17:45:50 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Dec  4 17:45:50 2016 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=wlan0 HWADDR=00:15:af:5f:33:56
Sun Dec  4 17:45:50 2016 TUN/TAP device tun0 opened
Sun Dec  4 17:45:50 2016 TUN/TAP TX queue length set to 100
Sun Dec  4 17:45:50 2016 do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
Sun Dec  4 17:45:50 2016 /sbin/ip link set dev tun0 up mtu 1500
Sun Dec  4 17:45:50 2016 /sbin/ip addr add dev tun0 80.67.179.112/22 broadcast 80.67.179.255
Sun Dec  4 17:45:50 2016 /sbin/ip -6 addr add 2001:910:1370:ffff::1/64 dev tun0
Sun Dec  4 17:45:52 2016 /sbin/ip route add 80.67.169.57/32 via 192.168.1.1
Sun Dec  4 17:45:52 2016 /sbin/ip route add 0.0.0.0/1 via 80.67.179.1
Sun Dec  4 17:45:52 2016 /sbin/ip route add 128.0.0.0/1 via 80.67.179.1
Sun Dec  4 17:45:52 2016 Initialization Sequence Completed
  • I'm using the very same file in the two cases (/foo/vpn.ovpn),
  • I'm using the same username / password,
  • This configuration worked flawlessly for years,
  • whatmyip.com confirms that my connexion via command line works fine,
  • I moved everything in /etc/NetworkManager/system-connections/ and re-created all the configurations.
  • 2
    what is the content of: /etc/NetworkManager/system-connections/[profile-name] – mikejonesey Dec 4 '16 at 20:09
  • 2
    Looks like NetworkManager uses UDP and the ovpn file uses TCP. You say "using the very same file", but NetworkManager never uses an ovpn file, instead you create a NetworkManager connection with the setting (possibly by importing the ovpn file). Compare your configuration. – thaller Dec 4 '16 at 22:34
  • Thanks for your comments, that helped me to be on the right track to debug this problem. I'm not sure I fully understand why I had this problem, so if you happen to have a more satisfactory answer, I'll gladly accept it. – Clément Dec 6 '16 at 1:16
1

Oddly enough moving the content of /etc/NetworkManager/system-connections, re-creating with network manager the connections and rebooting twice worked. The diff between my old configuration file and the new one shows three differences:

  • one in the uudi
  • one in the ca, which changed from ca=/foo/vpn-ca.crt to ca = /foo/vpn.ovpn.
  • and it removed [ipv6] method=auto
  • 1
    I just switched IPv6 settings to Ingnore and everything started to work – vladkras Nov 19 '19 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.