2

I would like to have systemd-networkd manage only specific properties (DNS server name and search domains) of tun interface which is otherwise configured by OpenVPN client (which assigns IP address). To achieve this I'm using the following network unit file:

[Match]
Name=ovpn

[Network]
DNS=10.0.0.1
Domains=lan

In this setup OpenVPN client starts, connects to a server, assigns IP address to the tun interface but the address is almost immediately removed from the interface. This can be seen in the following log:

systemd-networkd[18414]: ovpn: MAC address not found for new device, continuing without
systemd-networkd[18414]: ovpn: Flags change: +MULTICAST +POINTOPOINT +NOARP
systemd-networkd[18414]: ovpn: Link 36 added
systemd-networkd[18414]: ovpn: link pending udev initialization...
systemd-networkd[18414]: ovpn: Saved original MTU: 1500
systemd-networkd[18414]: ovpn: Flags change: +UP +LOWER_UP +RUNNING
systemd-networkd[18414]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_336 interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=21 reply_cookie=0 error=n/a
systemd-networkd[18414]: ovpn: Gained carrier
systemd-networkd[18414]: ovpn: Adding address: fe80::49c6:c30b:5f86:6622/64 (valid forever)
systemd-networkd[18414]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_336 interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=22 reply_cookie=0 error=n/a
systemd-networkd[18414]: ovpn: Gained IPv6LL
systemd-networkd[18414]: ovpn: Adding address: 10.1.1.100/22 (valid forever)
systemd-networkd[18414]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_336 interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=23 reply_cookie=0 error=n/a
systemd-networkd[18414]: ovpn: udev initialized link
systemd-networkd[18414]: ovpn: Link state is up-to-date
systemd-networkd[18414]: ovpn: found matching network '/etc/systemd/network/ovpn.network'
systemd-networkd[18414]: ovpn: Discovering IPv6 routers
systemd-networkd[18414]: NDISC: Started IPv6 Router Solicitation client
systemd-networkd[18414]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_336 interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=24 reply_cookie=0 error=n/a
systemd-networkd[18414]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_336 interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=25 reply_cookie=0 error=n/a
systemd-networkd[18414]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_336 interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=26 reply_cookie=0 error=n/a
systemd-networkd[18414]: NDISC: Sent Router Solicitation
systemd-networkd[18414]: ovpn: Removing address: 10.1.1.100/22 (valid forever)

Why is the IP address removed?
Can I manage only specific properties of network interface using systemd-networkd?

1

As zdzichu on #systemd Freenode's irc channel found out the behavior of networkd in regard to the state of link (interface) not set by networkd itself was establish with commit titled networkd: link - drop foreign config when configuring link with the following commit message (emphasis mine):

This is a change in behavior:

Before we would never remove any state, only add to it, we now drop unwanted state from any link the moment we start managing it.

Note however, that we still will not remove any foreign state added at runtime, to avoid any feedback loops. However, we make no guarantees about coexisting with third-party tools that change the state of the links we manage.

In the end trying to set link's properties outside of networkd is not race-free. Below is example from system's boot where the sequence of events is different and the end result is that interface keeps the IP address set by OpenVPN client.

systemd-networkd[1047]: ovpn: MAC address not found for new device, continuing without
systemd-networkd[1047]: ovpn: Flags change: +MULTICAST +POINTOPOINT +NOARP
systemd-networkd[1047]: ovpn: Link 4 added
systemd-networkd[1047]: ovpn: udev initialized link
systemd-networkd[1047]: ovpn: Saved original MTU: 1500
systemd-networkd[1047]: ovpn: Link state is up-to-date
systemd-networkd[1047]: ovpn: found matching network '/etc/systemd/network/ovpn.network'
systemd-networkd[1047]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_34 interface= (...)
systemd-networkd[1047]: ovpn: Bringing link up
systemd-networkd[1047]: ovpn: IPv6 enabled for interface: Success
systemd-networkd[1047]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_34 interface= (...)
systemd-networkd[1047]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_34 interface= (...)
systemd-networkd[1047]: ovpn: Flags change: +UP +LOWER_UP +RUNNING
systemd-networkd[1047]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_34 interface= (...)
systemd-networkd[1047]: ovpn: Gained carrier
systemd-networkd[1047]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_34 interface= (...)
systemd-networkd[1047]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_34 interface= (...)
systemd-networkd[1047]: ovpn: Adding address: fe80::ba0:a13:d13d:d438/64 (valid forever)
systemd-networkd[1047]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/network1/link/_34 interface= (...)
systemd-networkd[1047]: ovpn: Gained IPv6LL
systemd-networkd[1047]: ovpn: Discovering IPv6 routers
systemd-networkd[1047]: NDISC: Started IPv6 Router Solicitation client
systemd-networkd[1047]: NDISC: Sent Router Solicitation
systemd-networkd[1047]: ovpn: Adding address: 10.1.1.100/22 (valid forever)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.