Trying to get Amazon EC2 appliance from Amazon store to work

gearond

Installed the Amazon EC2 bundled Access Server. Pretty easy I must say. However, as always, it's in the details. I must have some wrong.
OS running the OpenVPN-AS server is ubuntu 12.04, fully updated after installation
OS running the openvpn client is the same, at home on UVerse.
Trying to access an Virtual Private Cloud with mostly private subnets.
I don't want my home machine to use any DHCP/DNS etc on amazon, just to be able to log onto the network and therefor log onto machines.
All machines are linux on the subnet, (one, not counting openvpn-as)
I put the OpenVPN-AS server in a public subnet, with a route of 0.0.0.0/0 and a Internet Gateway attached.
The range of the VPC is 10.0.0.0/16
The range of the private subnet is 10.0.9.0/24
The range of the public subnet is 10.0.8.0/24
Ports 443 and 1194 are open on the public subnet and/or server
I CAN SSH into the instance and I can run the GUI for both 'openvpn' user, a second user, and can get a client.ovpn for the second user.
OpenVPN-AS version is: 2.0.20
openvpn client version is: OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec 1 2014

Here is the client.ovpn contents, some details left out.

 gearond@METECH-LAPTOP:~$ openvpn --config $HOME/blah/blah/client.ovpn
# Automatically generated OpenVPN client config file
# Generated on Mon Oct 12 01:39:22 2015 by openvpnas2
# Note: this config file contains inline private keys
#       and therefore should be kept confidential!
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=second_account
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=second_account@amazon_elastic_ip/AUTOLOGIN
# OVPN_ACCESS_SERVER_AUTOLOGIN=1
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_BASIC_CLIENT=False
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=amazon_elastic_ip:443
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# -----BEGIN CERTIFICATE-----
#r#####################emoved for posting to forum#########################
# -----END CERTIFICATE-----
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=1
# OVPN_ACCESS_SERVER_ORGANIZATION=OpenVPN Technologies, Inc.
setenv FORWARD_COMPATIBLE 1
client
server-poll-timeout 4
nobind
remote amazon_elastic_ip 1194 udp
remote amazon_elastic_ip 1194 udp
remote amazon_elastic_ip 443 tcp
remote amazon_elastic_ip 1194 udp
remote amazon_elastic_ip 1194 udp
remote amazon_elastic_ip 1194 udp
remote amazon_elastic_ip 1194 udp
remote amazon_elastic_ip 1194 udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

<ca>
-----BEGIN CERTIFICATE-----
#r#####################emoved for posting to forum#########################
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
#r#####################emoved for posting to forum#########################
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
#r#####################emoved for posting to forum#########################
-----END PRIVATE KEY-----
</key>

key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key (Server Agent)
#
-----BEGIN OpenVPN Static key V1-----
#r#####################emoved for posting to forum#########################
-----END OpenVPN Static key V1-----
</tls-auth>

## -----BEGIN RSA SIGNATURE-----
## DIGEST:sha256
#r#####################emoved for posting to forum#########################
## -----END CERTIFICATE-----
## -----BEGIN CERTIFICATE-----
#r#####################emoved for posting to forum#########################
## -----END CERTIFICATE-----

Here is the verbose messages on the client (can't find where the logs are, they're not in /etc/openvpn)

Mon Oct 12 20:46:47 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Mon Oct 12 20:46:47 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Oct 12 20:46:47 2015 Control Channel Authentication: tls-auth using INLINE static key file
Mon Oct 12 20:46:47 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 12 20:46:47 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 12 20:46:47 2015 LZO compression initialized
Mon Oct 12 20:46:47 2015 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Oct 12 20:46:47 2015 Socket Buffers: R=[212992->200000] S=[212992->200000]
Mon Oct 12 20:46:47 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Oct 12 20:46:47 2015 Local Options hash (VER=V4): '504e774e'
Mon Oct 12 20:46:47 2015 Expected Remote Options hash (VER=V4): '14168603'
Mon Oct 12 20:46:47 2015 UDPv4 link local: [undef]
Mon Oct 12 20:46:47 2015 UDPv4 link remote: [AF_INET]amazon_elastic_ip:1194
Mon Oct 12 20:46:47 2015 TLS: Initial packet from [AF_INET]amazon_elastic_ip:1194, sid=3a2cbfbd 88edc572
Mon Oct 12 20:46:47 2015 VERIFY OK: depth=1, /CN=OpenVPN_CA
Mon Oct 12 20:46:47 2015 VERIFY OK: nsCertType=SERVER
Mon Oct 12 20:46:47 2015 VERIFY OK: depth=0, /CN=OpenVPN_Server
Mon Oct 12 20:46:48 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 12 20:46:48 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 12 20:46:48 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 12 20:46:48 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 12 20:46:48 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 2048 bit RSA
Mon Oct 12 20:46:48 2015 [OpenVPN_Server] Peer Connection Initiated with [AF_INET]amazon_elastic_ip:1194
Mon Oct 12 20:46:50 2015 SENT CONTROL [OpenVPN_Server]: 'PUSH_REQUEST' (status=1)
Mon Oct 12 20:46:51 2015 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,comp-lzo no,redirect-private def1,redirect-private bypass-dhcp,redirect-private autolocal,redirect-private bypass-dns,route-gateway 172.27.232.1,route 172.27.224.0 255.255.240.0,route 10.0.0.0 255.255.0.0,dhcp-option DOMAIN internal.quincepie.net,block-ipv6,ifconfig 172.27.232.2 255.255.248.0'
Mon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: dhcp-pre-release (2.2.1)
Mon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.2.1)
Mon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.2.1)
Mon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:19: block-ipv6 (2.2.1)
Mon Oct 12 20:46:51 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Oct 12 20:46:51 2015 OPTIONS IMPORT: explicit notify parm(s) modified
Mon Oct 12 20:46:51 2015 OPTIONS IMPORT: LZO parms modified
Mon Oct 12 20:46:51 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Oct 12 20:46:51 2015 OPTIONS IMPORT: route options modified
Mon Oct 12 20:46:51 2015 OPTIONS IMPORT: route-related options modified
Mon Oct 12 20:46:51 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Oct 12 20:46:51 2015 ROUTE default_gateway=192.168.1.254
Mon Oct 12 20:46:51 2015 Note: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Mon Oct 12 20:46:51 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Oct 12 20:46:51 2015 /sbin/ifconfig  172.27.232.2 netmask 255.255.248.0 mtu 1500 broadcast 172.27.239.255
SIOCSIFADDR: Operation not permitted
: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: Operation not permitted
SIOCSIFMTU: Operation not permitted
SIOCSIFBRDADDR: Operation not permitted
: ERROR while getting interface flags: No such device
Mon Oct 12 20:46:51 2015 Linux ifconfig failed: external program exited with error status: 255
Mon Oct 12 20:46:51 2015 Exiting

gearond

Here is content of config.json

{
  "Default": {
    "admin_ui.https.ip_address": "all", 
    "admin_ui.https.port": "943", 
    "auth.ldap.0.name": "My LDAP servers", 
    "auth.ldap.0.ssl_verify": "never", 
    "auth.ldap.0.timeout": "4", 
    "auth.ldap.0.use_ssl": "never", 
    "auth.module.type": "local", 
    "auth.pam.0.service": "openvpnas", 
    "auth.radius.0.acct_enable": "false", 
    "auth.radius.0.name": "My Radius servers", 
    "cs.cws_proto_v2": "true", 
    "cs.https.ip_address": "all", 
    "cs.https.port": "943", 
    "cs.prof_sign_web": "true", 
    "host.name": "amazon_elastic_ip", 
    "sa.initial_run_groups.0": "web_group", 
    "sa.initial_run_groups.1": "openvpn_group", 
    "vpn.client.basic": "false", 
    "vpn.client.routing.inter_client": "false", 
    "vpn.client.routing.reroute_dns": "false", 
    "vpn.client.routing.reroute_gw": "false", 
    "vpn.daemon.0.client.netmask_bits": "20", 
    "vpn.daemon.0.client.network": "172.27.224.0", 
    "vpn.daemon.0.listen.ip_address": "all", 
    "vpn.daemon.0.listen.port": "443", 
    "vpn.daemon.0.listen.protocol": "tcp", 
    "vpn.daemon.0.server.ip_address": "all", 
    "vpn.server.daemon.enable": "true", 
    "vpn.server.daemon.tcp.n_daemons": 1, 
    "vpn.server.daemon.tcp.port": "443", 
    "vpn.server.daemon.udp.n_daemons": 1, 
    "vpn.server.daemon.udp.port": "1194", 
    "vpn.server.group_pool.0": "172.27.240.0/20", 
    "vpn.server.nat.masquerade": "true", 
    "vpn.server.port_share.enable": "true", 
    "vpn.server.port_share.ip_address": "1.2.3.4", 
    "vpn.server.port_share.port": "1234", 
    "vpn.server.port_share.service": "admin+client", 
    "vpn.server.routing.private_access": "nat", 
    "vpn.server.routing.private_network.0": "10.0.0.0/16", 
    "vpn.tls_refresh.do_reauth": "true", 
    "vpn.tls_refresh.interval": "360"
  }, 
  "_INTERNAL": {
    "run_api.active_profile": "Default", 
    "webui.edit_profile": "Default"
   }
}

gearond

Here is what the log GUI says about the two attempts to connect

Node           Username              Start Time         Duration     Service    Real IP              VPN IP        Proto Port   Bytes In   Bytes Out   Error
openvpnas2     second_account        10/13/15 03:46     00:01        VPN        108.217.160.227      172.27.232.2  UDP  1194   5.06 KB	  5.83 KB	
openvpnas2     second_account        10/13/15 03:51     00:01        VPN        108.217.160.227      172.27.232.2  UDP  1194   5.20 KB	  5.82 KB

There were no errors on the receiving end
Makes me thing that the client doesn't like the DHCP options received.

Traffic

gearond wroteHere is the verbose messages on the client (can't find where the logs are, they're not in /etc/openvpn)

This is the openvpn log ...

gearond wroteCode:
Mon Oct 12 20:46:47 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec 1 2014

This is OpenVPN Community edition rather than the OpenVPN-AS Client ... perhaps you want to read about that AS-Client in the AS Docs.

gearond wroteMon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: dhcp-pre-release (2.2.1)
Mon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.2.1)
Mon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.2.1)
Mon Oct 12 20:46:51 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:19: block-ipv6 (2.2.1)

These options are only recognised by the AS-client not OpenVPN Community edition.

gearond wroteMon Oct 12 20:46:51 2015 ROUTE default_gateway=192.168.1.254

192.168.1.254 ... routing conflict maybe ...

gearond wroteMon Oct 12 20:46:51 2015 Note: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Mon Oct 12 20:46:51 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Oct 12 20:46:51 2015 /sbin/ifconfig 172.27.232.2 netmask 255.255.248.0 mtu 1500 broadcast 172.27.239.255
SIOCSIFADDR: Operation not permitted
: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: Operation not permitted
SIOCSIFMTU: Operation not permitted
SIOCSIFBRDADDR: Operation not permitted
: ERROR while getting interface flags: No such device
Mon Oct 12 20:46:51 2015 Linux ifconfig failed: external program exited with error status: 255
Mon Oct 12 20:46:51 2015 Exiting

Client must be run as root.

gearond

Thank you very muchy for those tips. I will look into it. I THOUGHT that the link to a client from the OpenVPN-AS GUI said to just download use the package manager and get 'openvpn'. I'll look again.

gearond

. ..... OK, I looked,the link on the GUI just directs me to download the standard openvpn package. I got it working much further using elevated privildges. What is supposed to happen after it runs? I.E., does the console window it's run in return to the prompt?

gearond

It now seems to mostly work. I used sudo privileges. Continuing on this topic of getting OpenVPN to work on EC2:

1/ I DO see the Tun0 in the ifconfig output.
I can ssh to the private IP address of the openvpn server.
however, I can't seem to get any DNS from the VPC I've connected to.

When I ssh into the server and do: cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 10.0.0.2
search internal.quincepie.net

When I just do that in a console on my home machine with the connection to the VPC/private network running, I get:
cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.0.1
search att.net

IS this correct? The name of the openvpn server is openvpnas2. I tried:
host openvpnas2.internal.quincepie.net
openvpnas2.internal.quincepie.net has address 50.63.202.46

and that is the parked address at godaddy for that domain (which I am not using)

IS THIS ALL CORRECT?

On the openvpn AS server, I did this:

 cat /usr/local/openvpn_as/etc/config.json
{
  "Default": {
    "admin_ui.https.ip_address": "all", 
    "admin_ui.https.port": "943", 
    "auth.ldap.0.name": "My LDAP servers", 
    "auth.ldap.0.ssl_verify": "never", 
    "auth.ldap.0.timeout": "4", 
    "auth.ldap.0.use_ssl": "never", 
    "auth.module.type": "local", 
    "auth.pam.0.service": "openvpnas", 
    "auth.radius.0.acct_enable": "false", 
    "auth.radius.0.name": "My Radius servers", 
    "cs.cws_proto_v2": "true", 
    "cs.https.ip_address": "all", 
    "cs.https.port": "943", 
    "cs.prof_sign_web": "true", 
    "host.name": "10.0.8.16", 
    "sa.initial_run_groups.0": "web_group", 
    "sa.initial_run_groups.1": "openvpn_group", 
    "vpn.client.basic": "false", 
    "vpn.client.routing.inter_client": "false", 
    "vpn.client.routing.reroute_dns": "true", 
    "vpn.client.routing.reroute_gw": "true", 
    "vpn.daemon.0.client.netmask_bits": "20", 
    "vpn.daemon.0.client.network": "172.27.224.0", 
    "vpn.daemon.0.listen.ip_address": "all", 
    "vpn.daemon.0.listen.port": "443", 
    "vpn.daemon.0.listen.protocol": "tcp", 
    "vpn.daemon.0.server.ip_address": "all", 
    "vpn.server.daemon.enable": "true", 
    "vpn.server.daemon.tcp.n_daemons": 1, 
    "vpn.server.daemon.tcp.port": "443", 
    "vpn.server.daemon.udp.n_daemons": 1, 
    "vpn.server.daemon.udp.port": "1194", 
    "vpn.server.group_pool.0": "172.27.240.0/20", 
    "vpn.server.nat.masquerade": "true", 
    "vpn.server.port_share.enable": "true", 
    "vpn.server.port_share.ip_address": "1.2.3.4", 
    "vpn.server.port_share.port": "1234", 
    "vpn.server.port_share.service": "admin+client", 
    "vpn.server.routing.private_access": "nat", 
    "vpn.server.routing.private_network.0": "10.0.8.0/24", 
    "vpn.tls_refresh.do_reauth": "true", 
    "vpn.tls_refresh.interval": "360"
  }, 
  "_INTERNAL": {
    "run_api.active_profile": "Default", 
    "webui.edit_profile": "Default"
  }

gearond

My client.ovpn file looks like this, (wihtout certs):

# Automatically generated OpenVPN client config file
# Generated on Fri Oct 16 22:56:48 2015 by openvpnas2
# Note: this config file contains inline private keys
#       and therefore should be kept confidential!
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=manager
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=blahblah@52.6.70.220/AUTOLOGIN
# OVPN_ACCESS_SERVER_AUTOLOGIN=1
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_BASIC_CLIENT=False
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=52.6.70.220:443
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# -----BEGIN CERTIFICATE-----
# -----cert removed----
# -----END CERTIFICATE-----
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=1
# OVPN_ACCESS_SERVER_ORGANIZATION=OpenVPN Technologies, Inc.
setenv FORWARD_COMPATIBLE 1
client
server-poll-timeout 4
nobind
remote 52.6.70.220 1194 udp
remote 52.6.70.220 1194 udp
remote 52.6.70.220 443 tcp
remote 52.6.70.220 1194 udp
remote 52.6.70.220 1194 udp
remote 52.6.70.220 1194 udp
remote 52.6.70.220 1194 udp
remote 52.6.70.220 1194 udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

<ca>
-----BEGIN CERTIFICATE-----
# -----cert removed----
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
# -----cert removed----
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
# -----cert removed----
-----END PRIVATE KEY-----
</key>

key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key (Server Agent)
#
-----BEGIN OpenVPN Static key V1-----
# -----cert removed----
</tls-auth>

## -----BEGIN RSA SIGNATURE-----
## DIGEST:sha256
# -----cert removed----
## -----END RSA SIGNATURE-----
## -----BEGIN CERTIFICATE-----
# -----cert removed----
## -----END CERTIFICATE-----
## -----BEGIN CERTIFICATE-----
# -----cert removed----
## -----END CERTIFICATE-----