Upgraded ubuntu, now openvpn doesn't work

gijs007

I've just done a fresh installation of Ubuntu server 15.04 on my virtual machine.
I then installed openvpn with the command: sudo apt-get install bridge-utils openvpn libssl-dev openssl

and enabled net.ipv4.ip_forward = 1 in /etc/sysctl.conf
After this I copied my old openvpn configuration from my Ubuntu 14.10 server.

I can connect to the vpn just fine, but I'm unable to ping from my client to 8.8.8.8 and I also can't reach any websites, which I could before..

What could be the issue?

gijs007

I forgot to chmod my up and down scripts, but after doing this it still doesn't work :?
I'm using the tap interface btw.

gijs007

I've found the following error in my syslog:
Apr 23 18:11:35 vpn-france systemd-udevd[340]: Could not generate persistent MAC address for tap0: No such file or directory

I tried putting auto tap0 in my interfaces configuration, then I rebooted.
Now it says unknown interface tap0 :?:

Traffic

gijs007 wroteunable to ping from my client to 8.8.8.8

did you enable iptables nat ?

gijs007 wroteNow it says unknown interface tap0

please post configs and logs at verb 4

gijs007

Traffic wrote
gijs007 wroteunable to ping from my client to 8.8.8.8
did you enable iptables nat ?
Didn't have that enabled on the old server, both servers have the same default iptables:

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

gijs007 wroteNow it says unknown interface tap0
please post configs and logs at verb 4

I've uploaded the syslog to: http://pastebin.com/Jbfw95G4
I've removed the server and client IP for security reasons 😉

Config is:

mode server
tls-server

local removed ## ip/hostname of server
port 500 ## default openvpn port
proto udp

#bridging directive
#dev tun
dev tap0 ## If you need multiple tap devices, add them here

persist-key
persist-tun

#certificates and encryption
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
tls-auth ta.key 0 # This file is secret

cipher BF-CBC        # Blowfish (default)
#fast-io
comp-lzo
comp-lzo yes
#DHCP Information
ifconfig-pool-persist ipp.txt
server 10.149.50.0  255.255.255.0 
;route removed 255.255.255.252
;push "route removed 255.255.255.252"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
;push "redirect-gateway"
push "redirect-gateway bypass-dhcp bypass-dns"
push "comp-lzo yes"
max-clients 10 ## set this to the max number of clients that should be connected at a time

#log and security
user nobody
group nogroup
keepalive 1 5
status openvpn-status.log
verb 4

up.sh

#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/sbin/brctl addif $BR $DEV

Traffic

gijs007 wroteI've uploaded the syslog to:

See --log in The Manual v23x

gijs007

I've used this:
log-append /var/log/openvpn.log

But I saw no errors in there, when you look in the syslog something go's wrong with udev:

 Apr 23 22:52:44 vpn-france systemd-udevd[338]: Could not generate persistent MAC address for tap0: No such file or directory

and sh:

Apr 23 22:52:44 vpn-france sh[788]: Unknown interface tap0

This is not logged in the openvpn log.

I think I need a new up and down.sh file that support the new systemd. :?:

Traffic

As you are trying to create a bridge you may want to use the supplied and support script to do so:
https://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html

gijs007

I've tried that, but I still see the same errors in my syslog about tap0 being unknown 🙁

I've attached my openvpn log as requested earlier:
http://pastebin.com/cNEVvXQE

I've noticed the following:

Fri Apr 24 22:42:51 2015 us=337340 /sbin/ip addr del dev tap0 10.149.50.1/24
RTNETLINK answers: Operation not permitted

Traffic

This:

gijs007 wroteRTNETLINK answers: Operation not permitted

can be caused by this:

Traffic wroteuser nobody
group nogroup

if you restart the process ..

For testing try removing the --user & --group directives from your config.

gijs007

Tried that, but I still get the same error. 🙁

Traffic

use sudo and service to start openvpn ..

gijs007

I've done sudo service openvpn stop and then sudo service openvpn start.
Although the error is gone, I still can't access the internet from my client..

Update:
I've noticed that actually commenting:
user nobody
group nogroup

did fix the error, even when not running it with sudo. I Must have accidentally read the previous log entry instead and thought that error still came up :shock:

So simply ignore my previous post:

gijs007 wroteTried that, but I still get the same error. 🙁

Traffic

gijs007 wroteI still can't access the internet from my client

you need to enable some kind of NAT at your server ..

The supported setting is one of the following:

General Linux:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Adjust 10.8.0.0/24 to match your chosen VPN subnet and eth0 to match your system WAN interface.

Michael wrotein VZ container the NAT rule needs to be setup a little different..

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j SNAT --to-source 1.2.3.4

1.2.3.4 is openvz real ip

https://forums.openvpn.net/topic18698.html#p51555

gijs007

I've re enabled:
user nobody
group nogroup

and made the IP table rules permanent.

I've noticed that if I restart the server my client(windows 8.1) loses connection and after the server is back the client reconnects, but the client remains unable to ping.
Only after restarting the client I'm able to ping again.