Hello everyone!
I just started using openvpn on my raspberry pi 2 with arch linux. My config works as long as I don't add route-noexec, which is what I desire to do. I don't want to route all traffic through my vpn, just whatever I chose.
client
dev tun
proto udp
remote openvpn.mullvad.net 1300
cipher AES-256-CBC
tun-ipv6
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
remote-cert-tls server
ping-restart 60
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh
ping 10
ca ca.crt
cert mullvad.crt
key mullvad.key
crl-verify crl.pem
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-SEED-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
and it changes my ip-address. Everyone is happy. The thing is I don't want to use the VPN for everything, so I add route-noexec to the bottom, and suddenly no traffic goes through. It still starts and connects to the server without complaining.
ifconfig shows this:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.1.6 netmask 255.255.255.0 broadcast 192.168.1.255
inet6 2a00:801:214:f81b:e25f:fbd8:4576:d966 prefixlen 64 scopeid 0x0<global>
inet6 2a00:801:214:f81b::5 prefixlen 64 scopeid 0x0<global>
inet6 2a00:801:214:f81b:ba27:ebff:fec8:ae12 prefixlen 64 scopeid 0x0<global>
inet6 fe80::ba27:ebff:fec8:ae12 prefixlen 64 scopeid 0x20<link>
ether b8:27:eb:c8:ae:12 txqueuelen 1000 (Ethernet)
RX packets 6006 bytes 423680 (413.7 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 3020 bytes 593614 (579.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 2348 bytes 185042 (180.7 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2348 bytes 185042 (180.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.114.0.52 netmask 255.255.0.0 destination 10.114.0.52
inet6 fd0c:4691:e29a:72::1032 prefixlen 112 scopeid 0x0<global>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 5 bytes 1421 (1.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 5 bytes 313 (313.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
When I do a curl --interface tun0 ipecho.net/plain nothing happens. When i connect without route-noexec this works like a charm. Adding route-noexec however, makes any tries to connect anything through it fail.
running curl --verbose --interface tun0 ipecho.net/plain results in:
* Trying 146.255.36.1...
* Local Interface tun0 is ip 10.114.0.101 using address family 2
* Local port: 0
and then it just hangs there until I kill it. using eth0 prints almost the same thing (but with interface ip being 192.168.1.6) but finishes the connection and prints my IP.
The output of route -n when connected (with route-noexec) is
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 1024 0 0 eth0
10.114.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.1.1 0.0.0.0 255.255.255.255 UH 1024 0 0 eth0
The log file when I try to connect (again with route-noexec) is:
Wed Aug 12 13:20:57 2015 OpenVPN 2.3.6 armv7l-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 2 2014
Wed Aug 12 13:20:57 2015 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.09
Wed Aug 12 13:20:57 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Aug 12 13:20:57 2015 WARNING: file 'mullvad.key' is group or others accessible
Wed Aug 12 13:20:57 2015 Socket Buffers: R=[163840->131072] S=[163840->131072]
Wed Aug 12 13:20:57 2015 UDPv4 link local: [undef]
Wed Aug 12 13:20:57 2015 UDPv4 link remote: [AF_INET]193.138.219.226:1300
Wed Aug 12 13:20:57 2015 TLS: Initial packet from [AF_INET]193.138.219.226:1300, sid=0452dd8c 90afe440
Wed Aug 12 13:20:57 2015 CRL: CRL crl.pem is from a different issuer than the issuer of certificate C=NA, ST=None, L=None, O=Mullvad, CN=Mullvad CA, emailAddress=info@mullvad.net
Wed Aug 12 13:20:57 2015 VERIFY OK: depth=2, C=NA, ST=None, L=None, O=Mullvad, CN=Mullvad CA, emailAddress=info@mullvad.net
Wed Aug 12 13:20:57 2015 CRL: CRL crl.pem is from a different issuer than the issuer of certificate C=NA, ST=None, L=None, O=Mullvad, CN=master.mullvad.net, emailAddress=info@mullvad.net
Wed Aug 12 13:20:57 2015 VERIFY OK: depth=1, C=NA, ST=None, L=None, O=Mullvad, CN=master.mullvad.net, emailAddress=info@mullvad.net
Wed Aug 12 13:20:57 2015 Validating certificate key usage
Wed Aug 12 13:20:57 2015 ++ Certificate has key usage 00a0, expects 00a0
Wed Aug 12 13:20:57 2015 VERIFY KU OK
Wed Aug 12 13:20:57 2015 Validating certificate extended key usage
Wed Aug 12 13:20:57 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Aug 12 13:20:57 2015 VERIFY EKU OK
Wed Aug 12 13:20:57 2015 CRL CHECK OK: C=NA, ST=None, L=None, O=Mullvad, CN=se3.mullvad.net, emailAddress=info@mullvad.net
Wed Aug 12 13:20:57 2015 VERIFY OK: depth=0, C=NA, ST=None, L=None, O=Mullvad, CN=se3.mullvad.net, emailAddress=info@mullvad.net
Wed Aug 12 13:20:58 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 12 13:20:58 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 12 13:20:58 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 12 13:20:58 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 12 13:20:58 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 12 13:20:58 2015 [se3.mullvad.net] Peer Connection Initiated with [AF_INET]193.138.219.226:1300
Wed Aug 12 13:21:01 2015 SENT CONTROL [se3.mullvad.net]: 'PUSH_REQUEST' (status=1)
Wed Aug 12 13:21:01 2015 PUSH: Received control message: 'PUSH_REPLY,ifconfig-ipv6 fd7d:2ced:46b4:72::105a/112 fd7d:2ced:46b4:72::,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.114.0.1,route-ipv6 0000::/2,route-ipv6 4000::/2,route-ipv6 8000::/2,route-ipv6 C000::/2,route-gateway 10.114.0.1,topology subnet,ifconfig 10.114.0.92 255.255.0.0'
Wed Aug 12 13:21:01 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 12 13:21:01 2015 OPTIONS IMPORT: route options modified
Wed Aug 12 13:21:01 2015 OPTIONS IMPORT: route-related options modified
Wed Aug 12 13:21:01 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Aug 12 13:21:01 2015 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:c8:ae:12
Wed Aug 12 13:21:01 2015 ROUTE6: default_gateway=UNDEF
Wed Aug 12 13:21:01 2015 TUN/TAP device tun0 opened
Wed Aug 12 13:21:01 2015 TUN/TAP TX queue length set to 100
Wed Aug 12 13:21:01 2015 do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
Wed Aug 12 13:21:01 2015 /usr/bin/ip link set dev tun0 up mtu 1500
Wed Aug 12 13:21:01 2015 /usr/bin/ip addr add dev tun0 10.114.0.92/16 broadcast 10.114.255.255
Wed Aug 12 13:21:01 2015 /usr/bin/ip -6 addr add fd7d:2ced:46b4:72::105a/112 dev tun0
Wed Aug 12 13:21:01 2015 /etc/openvpn/update-resolv-conf.sh tun0 1500 1558 10.114.0.92 255.255.0.0 init
dhcp-option DNS 10.114.0.1
Wed Aug 12 13:21:01 2015 Initialization Sequence Completed
Wed Aug 12 13:21:26 2015 event_wait : Interrupted system call (code=4)
Wed Aug 12 13:21:26 2015 Closing TUN/TAP interface
Wed Aug 12 13:21:26 2015 /usr/bin/ip addr del dev tun0 10.114.0.92/16
Wed Aug 12 13:21:26 2015 /etc/openvpn/update-resolv-conf.sh tun0 1500 1558 10.114.0.92 255.255.0.0 init
Wed Aug 12 13:21:27 2015 SIGINT[hard,] received, process exiting
I don't really know how to continue. Anyone got any ideas?
