0

I set up an openvpn client on Ubuntu 18.04 by creating a work.conf file under /etc/openvpn/

I start it with:

sudo systemctl start [email protected]

When I stop it,

sudo systemctl stop  [email protected]

it hangs for exactly 90 seconds before finally shutting down. Checking the logs shows the graceful shutdown timing out, at which point a SIGKILL is issued:

journalctl -n 6 -u [email protected]

12:59:51 systemd[1]: Stopping OpenVPN connection to work...
13:01:21 systemd[1]: [email protected]: State 'stop-sigterm' timed out. Killing.
13:01:21 systemd[1]: [email protected]: Killing process 12379 (openvpn) with signal SIGKILL.
13:01:21 systemd[1]: [email protected]: Main process exited, code=killed, status=9/KILL
13:01:21 systemd[1]: [email protected]: Failed with result 'timeout'.
13:01:21 systemd[1]: Stopped OpenVPN connection to work.

I've noticed a bunch of sleeping openvpn processes, some many days old:

ps ax -o command | grep --count '[o]penvpn'
35

ps ax -o stat,start,command | grep '[S]TAT\|[o]penvpn'
STAT  STARTED COMMAND
S     Aug 21  /bin/bash /etc/openvpn/update-resolv-conf tun0 1500 1553 ... ... init
S     Aug 21  run-parts --arg=-a --arg=tun0.openvpn /etc/resolvconf/update.d
...

I see a lot of similar processes in the service's cgroup:

systemd-cgls -u [email protected] | grep --count run-parts
34
systemd-cgls -u [email protected] | grep --count update-resolv-conf
17

I've also noticed that there is an openvpn.service in addition to my [email protected]. I'm not clear on the interaction between the two. I think my @work service is grouped under the other service, but not sure.

I'd like to figure out why the service fails to shutdown cleanly, and how/whether to clean up all those proceses that appear to be duplicates. What would you suggest as a next step?

I can post my conf file if that's useful...

1 Answer 1

0

I ran into a similar/same problem. Timeout when I wanted to stop the OpenVPN service...

It turned out that my update-resolv-conf file was the problem.

I suggest to comment out the up / down update-resolv-conf lines in your work.conf and check if the behaviour changes. Especially, as the processes seem to stay alive...

Best!

2
  • Did you find a replacement for update-resolv-conf or does your setup not involve any DNS config changes (i.e. using a different name-server when on the VPN than when off the VPN)?
    – ivan
    Oct 27, 2018 at 14:55
  • Previously I tried to use dnsmasq as local DNS proxy. However, it turned out to be a bad idea in conjunction with OpenVPN. I tried to restart the dnsmasq daemon after getting the new DNS servers from the OpenVPN conneciton within update-resolv-conf. Worked let's say sporadically. I disable and enable dnsmasq now with a little shell script work-around. Nov 4, 2018 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .