Newbie failing to start OpenVPN service on Linux

vincentvdn

Hello,

I just rented an unmanaged VPS Linux server running OpenVZ and CentOS 5.10 32bit. I know absolutely nothing about Linux and I just started following random online guides. I've been messing around for several hours, even having to look up how to use the nano editor, vi editor, stuff like that. So please talk to me as if I'm a baby. LOL

Anyway, I managed to successfully install OpenVPN, but it doesn't want to run.

Shutting down openvpn:                                     [  OK  ]
Starting openvpn:                                          [FAILED]

I obviously have no clue what my move should be here. I think there might be something wrong with the server.config file, because I just copy/pasted the contents from an online guide.

FYI:
TUN/TAP is activated
built certificate, CA, key server, diffie hellman
copy/pasted a config file and saved it

Here are the last lines of the /var/log/messages:

Sep 4 20:53:07 blabla openvpn[2716]: OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Sep 4 20:53:07 blabla openvpn[2716]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 4 20:53:07 blabla openvpn[2716]: PLUGIN_INIT: POST /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so '[/usr/share/openvpn/plugin/lib/openvpn-auth-pam.so] [/etc/pam.d/login]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY
Sep 4 20:53:07 blabla openvpn[2716]: Diffie-Hellman initialized with 1024 bit key
Sep 4 20:53:07 blabla openvpn[2716]: WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Sep 4 20:53:07 blabla openvpn[2716]: TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 4 20:53:07 blabla openvpn[2716]: Socket Buffers: R=[133120->131072] S=[133120->131072]
Sep 4 20:53:07 blabla openvpn[2716]: ROUTE: default_gateway=UNDEF
Sep 4 20:53:07 blabla openvpn[2716]: TUN/TAP device tun0 opened
Sep 4 20:53:07 blabla openvpn[2716]: TUN/TAP TX queue length set to 100
Sep 4 20:53:07 blabla openvpn[2716]: /sbin/ip link set dev tun0 up mtu 1500
Sep 4 20:53:07 blabla openvpn[2716]: /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sep 4 20:53:07 blabla openvpn[2716]: /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Sep 4 20:53:07 blabla openvpn[2716]: Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Sep 4 20:53:07 blabla openvpn[2723]: UDPv4 link local (bound): [undef]:1194
Sep 4 20:53:07 blabla openvpn[2723]: UDPv4 link remote: [undef]
Sep 4 20:53:07 blabla openvpn[2723]: MULTI: multi_init called, r=256 v=256
Sep 4 20:53:07 blabla openvpn[2723]: IFCONFIG POOL: base=10.8.0.4 size=62
Sep 4 20:53:07 blabla openvpn[2723]: Initialization Sequence Completed
Sep 4 21:01:18 blabla openvpn[2723]: event_wait : Interrupted system call (code=4)
Sep 4 21:01:18 blabla openvpn[2723]: TCP/UDP: Closing socket
Sep 4 21:01:18 blabla openvpn[2723]: /sbin/ip route del 10.8.0.0/24
Sep 4 21:01:18 blabla openvpn[2723]: Closing TUN/TAP interface
Sep 4 21:01:18 blabla openvpn[2723]: /sbin/ip addr del dev tun0 local 10.8.0.1 peer 10.8.0.2
Sep 4 21:01:18 blabla openvpn[2723]: PLUGIN_CLOSE: /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so
Sep 4 21:01:18 blabla openvpn[2723]: SIGTERM[hard,] received, process exiting
Sep 4 21:01:20 blabla openvpn[2774]: Options error: You must define TUN/TAP device (--dev)
Sep 4 21:01:20 blabla openvpn[2774]: Use --help for more information.
Sep 4 21:01:20 blabla openvpn[2777]: Options error: You must define TUN/TAP device (--dev)
Sep 4 21:01:20 blabla openvpn[2777]: Use --help for more information.
Sep 4 21:01:20 blabla openvpn[2780]: OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Sep 4 21:01:20 blabla openvpn[2780]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 4 21:01:20 blabla openvpn[2780]: Diffie-Hellman initialized with 1024 bit key
Sep 4 21:01:20 blabla openvpn[2780]: TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 4 21:01:20 blabla openvpn[2780]: Socket Buffers: R=[133120->131072] S=[133120->131072]
Sep 4 21:01:20 blabla openvpn[2780]: ROUTE: default_gateway=UNDEF
Sep 4 21:01:20 blabla openvpn[2780]: TUN/TAP device tun0 opened
Sep 4 21:01:20 blabla openvpn[2780]: TUN/TAP TX queue length set to 100
Sep 4 21:01:20 blabla openvpn[2780]: /sbin/ip link set dev tun0 up mtu 1500
Sep 4 21:01:20 blabla openvpn[2780]: /sbin/ip addr add dev tun0 local 10.0.0.1 peer 10.0.0.2
Sep 4 21:01:20 blabla openvpn[2780]: /sbin/ip route add 10.0.0.0/24 via 10.0.0.2
Sep 4 21:01:20 blabla openvpn[2780]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sep 4 21:01:20 blabla openvpn[2786]: GID set to users
Sep 4 21:01:20 blabla openvpn[2786]: UID set to nobody
Sep 4 21:01:20 blabla openvpn[2786]: UDPv4 link local (bound): [undef]:1194
Sep 4 21:01:20 blabla openvpn[2786]: UDPv4 link remote: [undef]
Sep 4 21:01:20 blabla openvpn[2786]: MULTI: multi_init called, r=256 v=256
Sep 4 21:01:20 blabla openvpn[2786]: IFCONFIG POOL: base=10.0.0.4 size=62
Sep 4 21:01:20 blabla openvpn[2786]: IFCONFIG POOL LIST
Sep 4 21:01:20 blabla openvpn[2786]: Initialization Sequence Completed
Sep 4 21:10:19 blabla openvpn[2786]: event_wait : Interrupted system call (code=4)
Sep 4 21:10:19 blabla openvpn[2786]: TCP/UDP: Closing socket
Sep 4 21:10:19 blabla openvpn[2786]: /sbin/ip route del 10.0.0.0/24
Sep 4 21:10:19 blabla openvpn[2786]: ERROR: Linux route delete command failed: external program exited with error status: 2
Sep 4 21:10:19 blabla openvpn[2786]: Closing TUN/TAP interface
Sep 4 21:10:19 blabla openvpn[2786]: /sbin/ip addr del dev tun0 local 10.0.0.1 peer 10.0.0.2
Sep 4 21:10:19 blabla openvpn[2786]: Linux ip addr del failed: external program exited with error status: 2
Sep 4 21:10:19 blabla openvpn[2786]: SIGTERM[hard,] received, process exiting
Sep 4 21:10:21 blabla openvpn[3035]: OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Sep 4 21:10:21 blabla openvpn[3035]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 4 21:10:21 blabla openvpn[3035]: Diffie-Hellman initialized with 1024 bit key
Sep 4 21:10:21 blabla openvpn[3035]: Cannot load certificate file server.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Sep 4 21:10:21 blabla openvpn[3035]: Exiting
Sep 4 21:10:21 blabla openvpn[3038]: Options error: You must define TUN/TAP device (--dev)
Sep 4 21:10:21 blabla openvpn[3038]: Use --help for more information.
Sep 4 21:10:21 blabla openvpn[3041]: Options error: You must define TUN/TAP device (--dev)
Sep 4 21:10:21 blabla openvpn[3041]: Use --help for more information.
Sep 4 21:10:21 blabla openvpn[3044]: OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Sep 4 21:10:21 blabla openvpn[3044]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 4 21:10:21 blabla openvpn[3044]: Diffie-Hellman initialized with 1024 bit key
Sep 4 21:10:21 blabla openvpn[3044]: Cannot load certificate file server.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
Sep 4 21:10:21 blabla openvpn[3044]: Exiting

It's possible that I actually messed up the whole thing, because I started trying out 3 "how to" guides at the same time and ended up trying out a bunch of different things.

Thank you for any advice. Sorry for being an idiot.

vincentvdn

Thank you for your fast reply! Obviously I am willing to do my own research as well by going through the documentation. I just thought it could save me some time if one of the more experienced people around here might be able to point out exactly where something is going wrong because of the error log. No need to reinvent the wheel! 🙂

This is what my config looks like

port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

ETA:

Traffic wroteTo get you off the ground, try this:
Static Key Mini Howto.

Ha! That makes things clearer already.

vincentvdn

So I reinstalled my server and started from scratch. I'm doing things clean now.

Everything went real smooth, I made a static key and used the minimal server config file from the how to:

dev tun
ifconfig 10.8.0.1 10.8.0.2
secret static.key

When I want to run the service, I get this:

Sep 8 21:38:36 blabla openvpn[20867]: OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Sep 8 21:38:36 blabla openvpn[20867]: IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA$
Sep 8 21:38:36 blabla openvpn[20867]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 8 21:38:36 blabla openvpn[20867]: Insufficient key material or header text not found in file 'static.key' (0/128/256 bytes found/min/max)
Sep 8 21:38:36 blabla openvpn[20867]: Exiting

Does the "found 0" mean that it cannot find the key? Because it's there. I checked it. A key was generated.
I googled around a bit but can't seem to find what to do.

vincentvdn

Thank you very much. Apparently I had two static.key files, one of which was an empty file in etc/openvpn/ so I copy pasted the contents of the other one in there and now I'm 1 step further.

Now the log says port 1194 is already in use.

Sep  8 23:18:06 blabla openvpn[21216]: OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr  5 2012
Sep  8 23:18:06 blabla openvpn[21216]: IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  $
Sep  8 23:18:06 blabla openvpn[21216]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep  8 23:18:06 blabla openvpn[21216]: WARNING: file 'static.key' is group or others accessible
Sep  8 23:18:06 blabla openvpn[21216]: TUN/TAP device tun0 opened
Sep  8 23:18:06 blabla openvpn[21216]: /sbin/ip link set dev tun0 up mtu 1500
Sep  8 23:18:06 blabla openvpn[21216]: /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sep  8 23:18:06 blabla openvpn[21221]: UDPv4 link local (bound): [undef]:1194
Sep  8 23:18:06 blabla openvpn[21221]: UDPv4 link remote: [undef]
Sep  8 23:18:06 blabla openvpn[21224]: OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr  5 2012
Sep  8 23:18:06 blabla openvpn[21224]: IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  $
Sep  8 23:18:06 blabla openvpn[21224]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep  8 23:18:06 blabla openvpn[21224]: WARNING: file 'static.key' is group or others accessible
Sep  8 23:18:06 blabla openvpn[21224]: TCP/UDP: Socket bind failed on local address [undef]:1194: Address already in use
Sep  8 23:18:06 blabla openvpn[21224]: Exiting

When I run ps -aux I can't see any pid 1194.
I already tried stopping the OpenVPN service and restarting it.

Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.4   2172   576 ?        Ss   Sep05   0:01 init [3]
root         2  0.0  0.0      0     0 ?        S    Sep05   0:00 [kthreadd/12241]
root         3  0.0  0.0      0     0 ?        S    Sep05   0:00 [khelper/12241]
root       233  0.0  0.2   2280   368 ?        S<s  Sep05   0:00 /sbin/udevd -d
root      1175  0.0  0.2   1832   364 ?        Ss   Sep05   0:03 syslogd -m 0
root      1251  0.0  0.2   2852   296 ?        Ss   Sep05   0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
root      1271  0.0  0.4   9340   588 ?        Ss   Sep05   0:04 sendmail: accepting connections
smmsp     1281  0.0  0.4   8288   536 ?        Ss   Sep05   0:00 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue
root      1291  0.0  0.2  10072   384 ?        Ss   Sep05   0:05 /usr/sbin/httpd
root      1300  0.0  0.2   4512   356 ?        Ss   Sep05   0:00 crond
root      1308  0.0  0.1   5712   240 ?        Ss   Sep05   0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam -n 2
root      1310  0.0  0.0   5712    64 ?        S    Sep05   0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam -n 2
root      1315  0.0  0.1   1764   212 tty1     Ss+  Sep05   0:00 /sbin/mingetty console
root      1316  0.0  0.1   1764   212 tty2     Ss+  Sep05   0:00 /sbin/mingetty tty2
root      4033  0.0  0.3  27540   496 ?        Ss   21:10   0:00 vzctl: pts/0
root      4034  0.0  0.7   3736  1024 pts/0    Ss   21:10   0:00 -bash
root      4087  0.0  0.6   7324   820 ?        Ss   21:11   0:00 /usr/sbin/sshd
root     21221  0.0  0.9   8872  1220 ?        Ss   23:18   0:00 /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/headsupcoach.pid --config heads
root     21243  0.0  0.6   2548   916 pts/0    R+   23:20   0:00 ps -aux
apache   29477  0.0  1.3  10072  1712 ?        S    Sep07   0:00 /usr/sbin/httpd
apache   29678  0.0  1.1  10072  1504 ?        S    Sep07   0:00 /usr/sbin/httpd

netstat -pnta

[root@blabla 2.0]# netstat -pnta
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      4087/sshd
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1271/sendmail
tcp        0      0 :::80                       :::*                        LISTEN      1291/httpd
tcp        0      0 :::22                       :::*                        LISTEN      4087/sshd

vincentvdn

It's up and running!!! Thank you so much, Traffic. You are my hero. You were spot on about everything.

I am now succesfully connected to my VPN. But when I run a speedtest online, my IP is still based in China. My VPS is actually in Singapore. Is this normal? When the OpenVPN icon is green and connected in Windows, all my traffic is going through the VPS, right?

I guess I still need to configure the server a bit better, is there anything "must-have" in there, apart from making it more resistant to connection failures? I will just be using it for personal use, I need low latency. It doesn't have to be crazy secure or anything. Just as fast and stable as possible.

vincentvdn

It seems my traffic is not going through the VPN connection. I can ping 10.8.0.1 fine.

However, when I run a traceroute it appears none of my stuff goes through the VPN. My internet became slower though.

How do I force the client (my computer) to run all traffic through the VPN connection?

vincentvdn

I followed that howto rigorously and restarted the openvpn service successfully but I can't notice any changes 🙁

Stupid question: on my windows client it's enough to simply have the OpenVPN GUI running, right? Or do I have to make some changes with my network settings? All of my internet traffic still simply goes through my normal connection.

This is the client's config:

remote 116.251.209.96
dev tun
ifconfig 10.8.0.2 10.8.0.1
secret static.key