0

So I'm having issues starting openvpn client in Fedora 34.

This is what I'm getting on the terminal

[root@mybox ~]# systemctl start openvpn-client@default
Job for [email protected] failed because the control process exited with error code.
See "systemctl status [email protected]" and "journalctl -xeu [email protected]" for details.
[root@mybox ~]# systemctl status openvpn-client@default
× [email protected] - OpenVPN tunnel for default
     Loaded: loaded (/usr/lib/systemd/system/[email protected]; disabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Mon 2021-08-09 18:35:01 AEST; 1s ago
       Docs: man:openvpn(8)
             https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
             https://community.openvpn.net/openvpn/wiki/HOWTO
    Process: 3970 ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf (code=exited, status=1/FAILURE)
   Main PID: 3970 (code=exited, status=1/FAILURE)
        CPU: 23ms

Aug 09 18:35:01 mybox systemd[1]: Starting OpenVPN tunnel for default...
Aug 09 18:35:01 mybox openvpn[3970]: Options error: In [CMD-LINE]:1: Error opening configuration file: default.conf
Aug 09 18:35:01 mybox openvpn[3970]: Use --help for more information.
Aug 09 18:35:01 mybox systemd[1]: [email protected]: Main process exited, code=exited, status=1/FAILURE
Aug 09 18:35:01 mybox systemd[1]: [email protected]: Failed with result 'exit-code'.
Aug 09 18:35:01 mybox systemd[1]: Failed to start OpenVPN tunnel for default.
[root@mybox ~]#

my config files are located in

root@mybox client]# ls -al
total 12
drwxr-x---. 1 root openvpn   60 Aug  9 03:47 .
drwxr-xr-x. 1 root root      60 Aug  9 03:47 ..
-rw-r--r--. 1 root openvpn 1818 Dec  8  2020 ca.crt
-rw-------. 1 root openvpn   23 Dec  8  2020 .credentials
-rw-r--r--. 1 root openvpn  535 Aug  9 03:55 default.conf
[root@mybox client]# pwd
/etc/openvpn/client

These are the contents of default.conf

[root@mybox client]# cat default.conf 
client
remote usa.my-vpn-server-here.com 1194 udp
remote usa.my-vpn-server-here.com 443 tcp-client

comp-lzo adaptive
ca /etc/openvpn/client/ca.crt
dev tun
tls-client
script-security 2
cipher AES-256-CBC
mute 10

route-delay 5
redirect-gateway def1
resolv-retry infinite
persist-key
persist-tun
remote-cert-tls server
mssfix

auth-user-pass /etc/openvpn/client/.credentials
auth-nocache

This is the systemd service.

I added " --verbose 9 --log /var/log/openvpn.log" in the hope I will be getting something in the log. BUT /var/log/openvpn.log doesn't exists even after running "systemctl start". I also run "systemctl daemon-reload" after editing the service file.

[Unit]
Description=OpenVPN tunnel for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/client
ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process

[Install]
WantedBy=multi-user.target

If I were to manually start openvpn using the value in "ExecStart", I do not get any error.

[root@mybox client]# /usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf --verb 9 --log /var/log/openvpn.log
WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
^C[root@mybox client]# /usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf
WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
OpenVPN 2.5.3 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 18 2021
library versions: OpenSSL 1.1.1k  FIPS 25 Mar 2021, LZO 2.10
TCP/UDP: Preserving recently used remote address: [AF_INET]24.123.153.76:1194
UDP link local: (not bound)
UDP link remote: [AF_INET]24.123.153.76:1194
[my-vpn-server-here.com] Peer Connection Initiated with [AF_INET]24.123.153.76:1194
WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
TUN/TAP device tun0 opened
net_iface_mtu_set: mtu 1500 for tun0
net_iface_up: set tun0 up
net_addr_v4_add: 24.123.0.47/16 dev tun0
Initialization Sequence Completed

Any ideas what can be wrong? Thanks!


UPDATE1:

  1. As a test, I copied the fedora config (certificate + .conf + credentials) files to Manjaro live USB. I installed openvpn via pacman and I had no issues starting OpenVPN via systemd.
  2. As a another test, I copied the .service file from Manjaro live USB into my Fedora setup and replaced the Fedora [email protected] and still cannot start OpenVPN via systemd.
5
  • 2
    This page -- community.openvpn.net/openvpn/wiki/Openvpn24ManPage -- indicates that the option is called --verb not --verbose. Does that make any difference?
    – Jeff Schaller
    Aug 8, 2021 at 23:14
  • @JeffSchaller Hi Jeff. thanks for picking up my mistake. But still not working. I was the one who added "--verbose 9" in the hopes I'll get more feedback. OpenVPN wasn't starting even before I made the change.
    – mrjayviper
    Aug 9, 2021 at 1:12
  • 1
    You have auth-user-pass twice in your config - try removing the first one, without the path.
    – Panki
    Aug 9, 2021 at 8:18
  • @Panki I made the change and still the same.
    – mrjayviper
    Aug 9, 2021 at 8:42
  • @JeffSchaller I removed "--verbose 9 --log" (basically what I added to the .service file) and reran the commands. I have also edited the original post to show the original errors.
    – mrjayviper
    Aug 9, 2021 at 8:43

1 Answer 1

1

In my situation, the problem was fixed by running fixfiles -R /etc/openvpn restore. I copied the files from somewhere else and maybe something (SELinux?) messed it up along the way.

It's my first time running Fedora.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .