No tun interface created, openvpn client & Debian

nineonine

Hi all,

Got a strange behavior on one of my server trying to connect to a remote OpenVPN server : as openvpn client starts, no tun0 interface seems to be created, i run an ifconfig and only eth0 and lo interfaces are shown.
In the openvpn logs, i can see that i get a timeout trying to connect :

Wed Jun 12 16:03:58 2013 us=914013 OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Sep 18 2008
Wed Jun 12 16:03:58 2013 us=914344 WARNING: file 'mykey.key' is group or others accessible
Wed Jun 12 16:03:58 2013 us=914660 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Wed Jun 12 16:03:58 2013 us=988956 LZO compression initialized
Wed Jun 12 16:03:58 2013 us=989053 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jun 12 16:03:58 2013 us=989106 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jun 12 16:03:58 2013 us=989133 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Jun 12 16:03:58 2013 us=989142 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Jun 12 16:03:58 2013 us=989165 Local Options hash (VER=V4): '69109d17'
Wed Jun 12 16:03:58 2013 us=989179 Expected Remote Options hash (VER=V4): 'c0103fa8'
Wed Jun 12 16:03:58 2013 us=992903 Attempting to establish TCP connection with XXX.XXX.XXX.XXX:1194 [nonblock]
Wed Jun 12 16:04:08 2013 us=993153 TCP: connect to XXX.XXX.XXX.XXX:1194 failed, will try again in 5 seconds: Connection timed out
Wed Jun 12 16:04:23 2013 us=993420 TCP: connect to XXX.XXX.XXX.XXX:1194 failed, will try again in 5 seconds: Connection timed out

I activated tun module by typing "modprobe tun" and the following command "lsmod | grep tun" returns correct.
Also, /dev/net/tun is present.

I don't manage the OpenVPN server, I only have to setup a client to connect to the server.
Environnement :
Debian Lenny
OpenVPN package 2.1_rc11

However, the same client configuration with the same keys does work on another machine under the same version of Debian and OpenVPN.

Has anyone ever experienced such an issue ? Seems that my server doesn't create any tun interface which causes the timeout as traffic can't be forwarded to eth0 ...

Thanks for your replies

janjust

the client cannot connect to the server because the server is not listening on that TCP port?
check to see if openvpn is running and check if the firewall/iptables rules allow access.

nineonine

Hi Jan,

Yes the server is listening on port 1194 as I can open a tunnel with another client machine and with the same server.

I also disabled all iptables rules on the client, every chain policy is set to ACCEPT and I can see the first packets going through my internet firewall on port 1194 to the server adress, but after that, nothing goes out anymore and I get the timeout messages in my OpenVPN client logs.

janjust

what's the difference between the working client vs the non-working client? different remote IP?

if the router accepts the incoming connection, then forwards that traffic to the VPN server then the problem must be on the VPN server itself; check the server logs and if possible, run

tcpdump -nnel -i eth0

and watch for openvpn traffic on the server.

nineonine

The remote IP is the same for the two clients as I used the same client conf file on both machines.

However, I dont manage the server so I can't access log files or run any command on it.
Itried again from several machines other than the one which causes me headache and sleepless nights and it works under Debian 5, 6, Windows 7 (yeah I know ... 😉 ) with the same remote server.

The only difference I notice between the machines is that on the one on which it works, when the OpenVPN client is started, I see a tun0 interface and in IP pushed by the server whereas on the one on which it doesn't work and when I lauch the OpenVPN client, no tunX interface is shown

I guess my problem comes more from a system / kernel issue as the tun interface is not set up when the client launches

janjust

openvpn 2.1rc11 is very old - see if you can upgrade to 2.2.2 or 2.3.2.

otherwise: if other clients work but this one doesn't then most likely it's a network/firewall issue on the Lenny box.

nineonine

Thanks for your reply Jan,

This topic can be closed, the core problem laid on a routing issue on my firewall.
I did first understand that the tun interface is created as the client launches but in fact it's only created once the client has established a communication with the server ...

Once my routing issue was solved, the client communicates well with the server and the tunnel is created