So I'm having issues starting openvpn client in Fedora 34.
This is what I'm getting on the terminal
[root@mybox ~]# systemctl start openvpn-client@default
Job for [email protected] failed because the control process exited with error code.
See "systemctl status [email protected]" and "journalctl -xeu [email protected]" for details.
[root@mybox ~]# systemctl status openvpn-client@default
× [email protected] - OpenVPN tunnel for default
Loaded: loaded (/usr/lib/systemd/system/[email protected]; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Mon 2021-08-09 18:35:01 AEST; 1s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Process: 3970 ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf (code=exited, status=1/FAILURE)
Main PID: 3970 (code=exited, status=1/FAILURE)
CPU: 23ms
Aug 09 18:35:01 mybox systemd[1]: Starting OpenVPN tunnel for default...
Aug 09 18:35:01 mybox openvpn[3970]: Options error: In [CMD-LINE]:1: Error opening configuration file: default.conf
Aug 09 18:35:01 mybox openvpn[3970]: Use --help for more information.
Aug 09 18:35:01 mybox systemd[1]: [email protected]: Main process exited, code=exited, status=1/FAILURE
Aug 09 18:35:01 mybox systemd[1]: [email protected]: Failed with result 'exit-code'.
Aug 09 18:35:01 mybox systemd[1]: Failed to start OpenVPN tunnel for default.
[root@mybox ~]#
my config files are located in
root@mybox client]# ls -al
total 12
drwxr-x---. 1 root openvpn 60 Aug 9 03:47 .
drwxr-xr-x. 1 root root 60 Aug 9 03:47 ..
-rw-r--r--. 1 root openvpn 1818 Dec 8 2020 ca.crt
-rw-------. 1 root openvpn 23 Dec 8 2020 .credentials
-rw-r--r--. 1 root openvpn 535 Aug 9 03:55 default.conf
[root@mybox client]# pwd
/etc/openvpn/client
These are the contents of default.conf
[root@mybox client]# cat default.conf
client
remote usa.my-vpn-server-here.com 1194 udp
remote usa.my-vpn-server-here.com 443 tcp-client
comp-lzo adaptive
ca /etc/openvpn/client/ca.crt
dev tun
tls-client
script-security 2
cipher AES-256-CBC
mute 10
route-delay 5
redirect-gateway def1
resolv-retry infinite
persist-key
persist-tun
remote-cert-tls server
mssfix
auth-user-pass /etc/openvpn/client/.credentials
auth-nocache
This is the systemd service.
I added " --verbose 9 --log /var/log/openvpn.log" in the hope I will be getting something in the log. BUT /var/log/openvpn.log doesn't exists even after running "systemctl start". I also run "systemctl daemon-reload" after editing the service file.
[Unit]
Description=OpenVPN tunnel for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/client
ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
[Install]
WantedBy=multi-user.target
If I were to manually start openvpn using the value in "ExecStart", I do not get any error.
[root@mybox client]# /usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf --verb 9 --log /var/log/openvpn.log
WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
^C[root@mybox client]# /usr/sbin/openvpn --suppress-timestamps --nobind --config default.conf
WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
OpenVPN 2.5.3 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 18 2021
library versions: OpenSSL 1.1.1k FIPS 25 Mar 2021, LZO 2.10
TCP/UDP: Preserving recently used remote address: [AF_INET]24.123.153.76:1194
UDP link local: (not bound)
UDP link remote: [AF_INET]24.123.153.76:1194
[my-vpn-server-here.com] Peer Connection Initiated with [AF_INET]24.123.153.76:1194
WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
TUN/TAP device tun0 opened
net_iface_mtu_set: mtu 1500 for tun0
net_iface_up: set tun0 up
net_addr_v4_add: 24.123.0.47/16 dev tun0
Initialization Sequence Completed
Any ideas what can be wrong? Thanks!
UPDATE1:
- As a test, I copied the fedora config (certificate + .conf + credentials) files to Manjaro live USB. I installed openvpn via pacman and I had no issues starting OpenVPN via systemd.
- As a another test, I copied the .service file from Manjaro live USB into my Fedora setup and replaced the Fedora [email protected] and still cannot start OpenVPN via systemd.
--verbnot--verbose. Does that make any difference?auth-user-passtwice in your config - try removing the first one, without the path.