When ip calls via sudo, OpenVPN can't start via systemctl

shau-kote

Hello.

I configure OpenVPN on VPS (Fedora 23) and I have the problem described in the subject.
I wrote client and server configs and all works fine while I start OpenVPN manually from command line.
But when I try start OpenVPN server as systemd service it fails:

[shau-kote@myvps openvpn]$ sudo systemctl status openvpn@matroskin-tcp.service 
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Thu 2015-12-10 18:36:24 UTC; 3s ago
  Process: 1063 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
 Main PID: 1064 (code=exited, status=1/FAILURE)

Dec 10 18:36:24 myvps openvpn[1064]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01
Dec 10 18:36:24 myvps openvpn[1064]: TUN/TAP device tun0 opened
Dec 10 18:36:24 myvps openvpn[1064]: TUN/TAP TX queue length set to 100
Dec 10 18:36:24 myvps openvpn[1064]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Dec 10 18:36:24 myvps openvpn[1064]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500
Dec 10 18:36:24 myvps openvpn[1064]: Linux ip link set failed: could not execute external program
Dec 10 18:36:24 myvps openvpn[1064]: Exiting due to fatal error
Dec 10 18:36:24 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE
Dec 10 18:36:24 myvps systemd[1]: openvpn@server.service: Unit entered failed state.
Dec 10 18:36:24 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'.
[shau-kote@myvps openvpn]$

As long as I want to run OpenVPN server unprivileged I configured it as it described in official howto: I add "iproute /usr/local/sbin/unpriv-ip" line in server config, create corresponding executable script and configure sudo.
And I discover that if remove "iproute /usr/local/sbin/unpriv-ip" line from server config it starts correctly (and works fine):

[shau-kote@myvps openvpn]$ sudo systemctl start openvpn@server.service 
[shau-kote@myvps openvpn]$ sudo systemctl status openvpn@server.service 
● openvpn@matroskin-tcp.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2015-12-10 19:04:33 UTC; 2s ago
  Process: 1255 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
 Main PID: 1256 (openvpn)
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─1256 /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server.pid --cd /etc/openvpn/ --config server.conf

Dec 10 19:04:33 myvps openvpn[1256]: GID set to openvpn
Dec 10 19:04:33 myvps openvpn[1256]: UID set to openvpn
Dec 10 19:04:33 myvps openvpn[1256]: Listening for incoming TCP connection on [undef]
Dec 10 19:04:33 myvps openvpn[1256]: TCPv4_SERVER link local (bound): [undef]
Dec 10 19:04:33 myvps openvpn[1256]: TCPv4_SERVER link remote: [undef]
Dec 10 19:04:33 myvps openvpn[1256]: MULTI: multi_init called, r=256 v=256
Dec 10 19:04:33 myvps openvpn[1256]: IFCONFIG POOL: base=10.13.7.4 size=62, ipv6=0
Dec 10 19:04:33 myvps openvpn[1256]: IFCONFIG POOL LIST
Dec 10 19:04:33 myvps openvpn[1256]: MULTI: TCP INIT maxclients=2 maxevents=6
Dec 10 19:04:33 myvps openvpn[1256]: Initialization Sequence Completed
[shau-kote@myvps openvpn]$

But in this case when OpenVPN cannot normaly stop because it has not enough rights:

[shau-kote@myvps openvpn]$ sudo systemctl stop openvpn@server.service 
[shau-kote@myvps openvpn]$ sudo systemctl status openvpn@server.service 
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

Dec 10 19:05:15 myvps openvpn[1256]: shau-kote/176.59.38.55:59166 Connection reset, restarting [0]
Dec 10 19:05:15 myvps openvpn[1256]: shau-kote/176.59.38.55:59166 SIGUSR1[soft,connection-reset] received, client-instance restarting
Dec 10 19:07:45 myvps openvpn[1256]: /usr/sbin/ip route del 10.13.7.0/24
Dec 10 19:07:45 myvps systemd[1]: Stopping OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp...
Dec 10 19:07:45 myvps openvpn[1256]: ERROR: Linux route delete command failed: external program exited with error status: 2
Dec 10 19:07:45 myvps openvpn[1256]: Closing TUN/TAP interface
Dec 10 19:07:45 myvps openvpn[1256]: /usr/sbin/ip addr del dev tun0 local 10.13.7.1 peer 10.13.7.2
Dec 10 19:07:45 myvps openvpn[1256]: Linux ip addr del failed: external program exited with error status: 2
Dec 10 19:07:45 myvps openvpn[1256]: SIGTERM[hard,] received, process exiting
Dec 10 19:07:45 myvps systemd[1]: Stopped OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp.
[shau-kote@myvps openvpn]$

Well, summary:

"iproute /usr/local/sbin/unpriv-ip" + manually start = works fine
"iproute /usr/local/sbin/unpriv-ip" + systemctl = cannot starts
no "iproute /usr/local/sbin/unpriv-ip" + systemctl = starts fine, but cannot stops

This situation is discouraging and unpleasant for me.

I want to start (and correctly stop) OpenVPN server via systemctl.
I do not understand what happens and what is the problem.

Could comeone explain me what is the problem?
Thank you.