7

I have compiled openvpn from source, running openvpn --version returns:

OpenVPN 2.4.4 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Nov 19 2017
library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08

And created a /etc/openvpn/server.conf file with some basic settings. However, when I try to start it with sudo systemctl start openvpn@server it returns

Failed to start openvpn@server.service: Unit openvpn@server.service not found.

And sudo systemctl status openvpn returns:

● openvpn.service
   Loaded: masked (/dev/null; bad)
   Active: inactive (dead) since Sun 2017-11-19 14:21:06 HKT; 4 days ago
 Main PID: 1502 (code=exited, status=0/SUCCESS)

Which makes me think that openvpn service is not even registered.

I have checked /lib/systemd/system/, it doesn't have openvpn.service file, but /etc/systemd/system/ does. As I understand this is because I compiled instead of apt-get install openvpn?

Can anyone suggest how should I add self-compiled openvpn as a service?

First time compiling from source, so any advise/tips much appreciated!

EDIT 1:

I can start openvpn server and connect clients to it with (only service doesn't seem to work):

sudo openvpn /etc/openvpn/server.conf
3
  • 1
    your best bet is to install the official package and inspecting/using the official files. Nov 23, 2017 at 9:55
  • 1
    Can you post the output of openvpn /etc/openvpn/server.conf?I think you need to update your systemd files accordingly to match with the paths and settings of your self-compiled version. Nov 23, 2017 at 10:08
  • 1
    Hey @WilliamSandin, sudo openvpn /etc/openvpn/server.conf starts the openvpn server, I am able to connect clients. Only the systemctl doesn't seem to work.
    – Ilya
    Nov 23, 2017 at 12:09

2 Answers 2

6

Made it work by manually creating two files in /lib/systemd/system.

The first one is openvpn.service:

[Unit]
Description=OpenVPN service
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecReload=/bin/true
WorkingDirectory=/etc/openvpn

[Install]
WantedBy=multi-user.target

and second is openvpn@.service:

[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
PrivateTmp=true
KillMode=mixed
Type=forking
ExecStart=/usr/local/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn
ProtectSystem=yes
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw

[Install]
WantedBy=multi-user.target

After creating them, do sudo systemctl daemon-reload to reload the new changes.

Generally, the files are the same, as if openvpn was installed from official repo, the only difference is ExecStart=/usr/sbin/openvpn should be ExecStart=/usr/local/sbin/openvpn, pointing to compiled local openVPN.

Edit: If you use openvpn 2.4+, remove PIDFile=/run/openvpn/%i.pid and --writepid /run/openvpn/%i.pid from the second file, as it prevents server from starting on boot. Found it here

3

Updating from answer by Ilya (I don't have reputation to comment)

I have it working on Ubuntu 16.04 by using the provided service as a template (so a single service file), changing two things:

sudo cp ~/Downloads/openvpn-2.4.8/distro/systemd/openvpn-client@.service.in /lib/systemd/system/openvpn-client@.service

sudo vi /lib/systemd/system/openvpn-client@.service

Change:

  • @sbindir@ to /usr/local/sbin/
  • Type=notify to Type=simple

Reload and Start

sudo systemctl daemon-reload
service openvpn-client@client.service restart
service openvpn-client@client.service status

This assumes you've already got your config in /etc/openvpn/client/client.service.conf

2
  • If this is for the server, why do you copy the openvpn-client.service? How can a client be a service? I don't understand that. Why didn't you copy openvpn-server@.service.in? Thanks
    – Houman
    Jul 22, 2020 at 17:51
  • 1
    indeed - I used this for a client - not server.
    – River Rock
    Jul 23, 2020 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.