OpenVPN Error

rolf_eloy

Hello,

I'm getting the error below (on the client) when running VPN for a while:

Fri Oct 4 04:13:37 2013 Re-using SSL/TLS context
Fri Oct 4 04:13:37 2013 LZO compression initialized
Fri Oct 4 04:13:37 2013 UDPv4 link local: [undef]
Fri Oct 4 04:13:37 2013 UDPv4 link remote: [AF_INET]64.XX.XX.XX:6489
Fri Oct 4 04:13:37 2013 [changeme] Peer Connection Initiated with [AF_INET]64.XX.XX.XX:6489
Fri Oct 4 04:13:39 2013 Preserving previous TUN/TAP instance: tap_to_serv4
Fri Oct 4 04:13:39 2013 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
Fri Oct 4 04:13:39 2013 /sbin/ifconfig tap_to_serv4 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Fri Oct 4 04:13:39 2013 Linux ip addr del failed: external program exited with error status: 255
Fri Oct 4 04:13:40 2013 Note: Cannot ioctl TUNSETIFF tap_to_serv4: Operation not permitted (errno=1)
Fri Oct 4 04:13:40 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Oct 4 04:13:40 2013 /sbin/ifconfig 172.XX.XX.3 netmask 255.255.255.0 mtu 1500 broadcast 172.XX.X.255
SIOCSIFADDR: Permission denied
: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: Permission denied
SIOCSIFMTU: Operation not permitted
SIOCSIFBRDADDR: Permission denied
: ERROR while getting interface flags: No such device
Fri Oct 4 04:13:40 2013 Linux ifconfig failed: external program exited with error status: 255
Fri Oct 4 04:13:40 2013 Exiting

Any clue what this could be?

maikcat

are you running openvpn with root privs?

Michael.

rolf_eloy

maikcat wroteare you running openvpn with root privs?

Michael.

Yes I do!!

rolf_eloy

I'm still having this problem.. below is a more recent log:

Fri Oct 25 10:21:00 2013 Initialization Sequence Completed
Sat Oct 26 03:08:48 2013 [changeme] Inactivity timeout (--ping-restart), restarting
Sat Oct 26 03:08:48 2013 SIGUSR1[soft,ping-restart] received, process restarting
Sat Oct 26 03:08:50 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 26 03:08:50 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Oct 26 03:08:50 2013 Re-using SSL/TLS context
Sat Oct 26 03:08:50 2013 LZO compression initialized
Sat Oct 26 03:08:50 2013 UDPv4 link local: [undef]
Sat Oct 26 03:08:50 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:6489
Sat Oct 26 03:09:50 2013 [UNDEF] Inactivity timeout (--ping-restart), restarting
Sat Oct 26 03:09:50 2013 SIGUSR1[soft,ping-restart] received, process restarting
Sat Oct 26 03:09:52 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 26 03:09:52 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Oct 26 03:09:52 2013 Re-using SSL/TLS context
Sat Oct 26 03:09:52 2013 LZO compression initialized
Sat Oct 26 03:09:52 2013 UDPv4 link local: [undef]
Sat Oct 26 03:09:52 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:6489
Sat Oct 26 03:10:52 2013 [UNDEF] Inactivity timeout (--ping-restart), restarting
Sat Oct 26 03:10:52 2013 SIGUSR1[soft,ping-restart] received, process restarting
Sat Oct 26 03:10:54 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 26 03:10:54 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Oct 26 03:10:54 2013 Re-using SSL/TLS context
Sat Oct 26 03:10:54 2013 LZO compression initialized
Sat Oct 26 03:10:54 2013 UDPv4 link local: [undef]
Sat Oct 26 03:10:54 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:6489
Sat Oct 26 03:10:54 2013 [changeme] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:6489
Sat Oct 26 03:10:56 2013 Preserving previous TUN/TAP instance: tap_to_serv2
Sat Oct 26 03:10:56 2013 Initialization Sequence Completed
Sat Oct 26 03:12:57 2013 [changeme] Inactivity timeout (--ping-restart), restarting
Sat Oct 26 03:12:57 2013 SIGUSR1[soft,ping-restart] received, process restarting
Sat Oct 26 03:12:59 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 26 03:12:59 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Oct 26 03:12:59 2013 Re-using SSL/TLS context
Sat Oct 26 03:12:59 2013 LZO compression initialized
Sat Oct 26 03:12:59 2013 UDPv4 link local: [undef]
Sat Oct 26 03:12:59 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:6489
Sat Oct 26 03:13:13 2013 [changeme] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:6489
Sat Oct 26 03:13:16 2013 Preserving previous TUN/TAP instance: tap_to_serv2
Sat Oct 26 03:13:16 2013 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
Sat Oct 26 03:13:16 2013 /sbin/ifconfig tap_to_serv2 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Sat Oct 26 03:13:16 2013 Linux ip addr del failed: external program exited with error status: 255
Sat Oct 26 03:13:17 2013 Note: Cannot ioctl TUNSETIFF tap_to_serv2: Operation not permitted (errno=1)
Sat Oct 26 03:13:17 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Oct 26 03:13:17 2013 /sbin/ifconfig  YYY.YYY.YYY.3 netmask 255.255.255.0 mtu 1500 broadcast YYY.YYY.YYY.255
SIOCSIFADDR: Permission denied
: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: Permission denied
SIOCSIFMTU: Operation not permitted
SIOCSIFBRDADDR: Permission denied
: ERROR while getting interface flags: No such device
Sat Oct 26 03:13:17 2013 Linux ifconfig failed: external program exited with error status: 255
Sat Oct 26 03:13:17 2013 Exiting

rolf_eloy

This is another long from the same client.

By the way OpenVPN keeps running without problems on the server.

root@client:/home/admin/openvpn/logs# cat serv3.log 
Thu Oct 24 07:56:28 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Thu Oct 24 07:56:28 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Oct 24 07:56:28 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Oct 24 07:56:28 2013 WARNING: file '/home/admin/openvpn/keys/serv3/client.key' is group or others accessible
Thu Oct 24 07:56:28 2013 WARNING: file '/home/admin/openvpn/keys/serv3/ta.key' is group or others accessible
Thu Oct 24 07:56:28 2013 Control Channel Authentication: using '/home/admin/openvpn/keys/serv3/ta.key' as a OpenVPN static key file
Thu Oct 24 07:56:28 2013 LZO compression initialized
Thu Oct 24 07:56:28 2013 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Oct 24 07:56:28 2013 UDPv4 link local: [undef]
Thu Oct 24 07:56:28 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.2:6489
Thu Oct 24 07:56:32 2013 [changeme] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.2:6489
Thu Oct 24 07:56:34 2013 TUN/TAP device tap_to_serv3 opened
Thu Oct 24 07:56:34 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Oct 24 07:56:34 2013 /sbin/ifconfig tap_to_serv3 YYY.YYY.YYY.3 netmask 255.255.255.0 mtu 1500 broadcast YYY.YYY.YYY.255
Thu Oct 24 07:56:34 2013 /bin/bash /home/admin/openvpn/scripts/tunnel_to_serv3.up.sh tap_to_serv3 1500 1574 YYY.YYY.YYY.3 255.255.255.0 init
Thu Oct 24 07:56:34 2013 GID set to nogroup
Thu Oct 24 07:56:34 2013 UID set to nobody
Thu Oct 24 07:56:34 2013 Initialization Sequence Completed
Sat Oct 26 04:20:45 2013 [changeme] Inactivity timeout (--ping-restart), restarting
Sat Oct 26 04:20:45 2013 SIGUSR1[soft,ping-restart] received, process restarting
Sat Oct 26 04:20:47 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 26 04:20:47 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Oct 26 04:20:47 2013 Re-using SSL/TLS context
Sat Oct 26 04:20:47 2013 LZO compression initialized
Sat Oct 26 04:20:47 2013 UDPv4 link local: [undef]
Sat Oct 26 04:20:47 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.2:6489
Sat Oct 26 04:21:04 2013 [changeme] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.2:6489
Sat Oct 26 04:21:06 2013 Preserving previous TUN/TAP instance: tap_to_serv3
Sat Oct 26 04:21:06 2013 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
Sat Oct 26 04:21:06 2013 /sbin/ifconfig tap_to_serv3 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Sat Oct 26 04:21:06 2013 Linux ip addr del failed: external program exited with error status: 255
Sat Oct 26 04:21:08 2013 Note: Cannot ioctl TUNSETIFF tap_to_serv3: Operation not permitted (errno=1)
Sat Oct 26 04:21:08 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Oct 26 04:21:08 2013 /sbin/ifconfig  YYY.YYY.YYY.2 netmask 255.255.255.0 mtu 1500 broadcast YYY.YYY.YYY.255
SIOCSIFADDR: Permission denied
: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: Permission denied
SIOCSIFMTU: Operation not permitted
SIOCSIFBRDADDR: Permission denied
: ERROR while getting interface flags: No such device
Sat Oct 26 04:21:08 2013 Linux ifconfig failed: external program exited with error status: 255
Sat Oct 26 04:21:08 2013 Exiting

Again: I'm running as root, and it all seems to run fine for a while (2 days?) but then the client will crash...

rolf_eloy

Hello debbie10t,
Thanks for your reply.

I understand that the etiquette of this forum is to paste the VPN configs, but since this is part of a project that is under a NDA I cannot do this.

Anyway, I would share the configs with individuals that are able to help me, e.g. via PM.
By the way, I seriously want to get this resolved so I'm willing to pay for this.
If somebody of you is at oDesk (or equivalent) please contact me via PM!

maikcat

what distro are you using?

Michael.

rolf_eloy

Hey debbie10t and maikcat, thanks for your replies!

Maikcat, I'm using Ubuntu 12 on both, client and server.

debbie10t, I have compiled the configs for you, please see below.
A privileges issues might be a good hint. This issue has causing a lot of headaches for me since it's difficult to replicate.
The client will run fine but then suddenly crash after 2-3 days. I'm running OpenVPN as "nobody":

local S.S.S.S
dev tap0
port 6489
server 172.16.10.0 255.255.255.0
ifconfig-pool-persist /home/admin/openvpn/ipp.txt
client-config-dir /home/admin/openvpn/clients
tls-auth /home/admin/openvpn/ta.key 0
ca /home/admin/openvpn/ca.crt
cert /home/admin/openvpn/server.crt
key /home/admin/openvpn/server.key
dh /home/admin/openvpn/dh1024.pem
duplicate-cn
keepalive 10 60
cipher BF-CBC
log /home/admin/openvpn/logs/server.log
comp-lzo
ping-timer-rem
persist-tun
persist-key
user nobody
group nogroup
status /home/admin/openvpn/openvpn.status
writepid /var/run/openvpn.server.pid
daemon
verb 3
mute 0
script-security 2
up "/bin/bash /home/admin/openvpn/scripts/backroutes_server.sh" # /sbin/ip route add to 10.0.0.0/8 dev tap0

The Client:

client
remote S.S.S.S 6489
dev tap_to_server
ca /home/admin/openvpn/keys/server/ca.crt
cert /home/admin/openvpn/keys/server/client.crt
key /home/admin/openvpn/keys/server/client.key
tls-auth /home/admin/openvpn/keys/server/ta.key 1
comp-lzo
daemon
user nobody
group nogroup
persist-key
persist-tun
nobind
keepalive 10 60
writepid /var/run/openvpn.tunnel_to_server.pid
log /home/admin/openvpn/logs/server.log
status /home/admin/openvpn/status/server.status 20
script-security 2
up "/bin/bash /home/admin/openvpn/scripts/tunnel_to_server.up.sh" # /sbin/ip route add default via 172.16.10.1 dev tap_to_server table route-to-server

maikcat

you did not installed selinux right?

Michael.

rolf_eloy

No, there doesn't seem to be selinux installed on this server.

# dpkg -s selinux
Package `selinux' is not installed and no info is available.
Use dpkg --info (= dpkg-deb --info) to examine archive files,
and dpkg --contents (= dpkg-deb --contents) to list their contents.

# dpkg -s selinux-policy-ubuntu
Package `selinux-policy-ubuntu' is not installed and no info is available.
Use dpkg --info (= dpkg-deb --info) to examine archive files,
and dpkg --contents (= dpkg-deb --contents) to list their contents.

rolf_eloy

Bumping this thread :roll:

rolf_eloy

debbie10t wroteShould you not be using dev tun ?

Well, the setup is working fine for my needs. The only issue is that sometimes some Open VPN clients break down.
Do you think this might be related to using dev tun?

rolf_eloy

Would it be possible to hire some of you guys for this task?
I'm looking for someone to help me with this in-depth, and to refactor my current setup maybe.

I have hard times finding somebody on freelancer websites who has the OpenVPN knowhow like you guys.
Please PM me for details, I would prefer to do this via ODesk or Skype+PayPal