status openvpn server service error

mflac

I am struggling to set up a vpn on my raspberry. I'm trying to follow the posting directions but I don't really understand how to use BBCode, despite reading the instructions. My apologies in advance.

I have a domain via google and am forwarding pi.myserver.com to my raspberry.
I have set up an apache server on the raspberry and can reach it from the outside world. I can also ssh without problem.
Port 1194 is forwarded.

On the client side I get:
Transport Error: DNS resolve error on '<pi.mydomain.com>' for UDP session: Host not found.

/home/pi# sudo systemctl status openvpn
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
   Active: active (exited) since Thu 2016-12-15 15:48:00 PST; 1min 33s ago
  Process: 703 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 703 (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/openvpn.service

Dec 15 15:48:00 raspberrypi systemd[1]: Started OpenVPN service.

:/home/pi# sudo systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN connection to server
   Loaded: loaded (/lib/systemd/system/openvpn@.service; disabled)
   Active: failed (Result: exit-code) since Thu 2016-12-15 15:47:56 PST; 2min 55s ago
  Process: 430 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf (code=exited, status=1/FAILURE)

Dec 15 15:47:56 raspberrypi systemd[1]: Starting OpenVPN connection to server...
Dec 15 15:47:56 raspberrypi systemd[1]: openvpn@server.service: control process exited, code=exited status=1
Dec 15 15:47:56 raspberrypi systemd[1]: Failed to start OpenVPN connection to server.
Dec 15 15:47:56 raspberrypi systemd[1]: Unit openvpn@server.service entered failed state.

:/home/pi#  sudo cat /var/log/openvpn.log
Thu Dec 15 16:01:23 2016 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016
Thu Dec 15 16:01:23 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Thu Dec 15 16:01:23 2016 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Thu Dec 15 16:01:23 2016 TCP/UDP: Socket bind failed on local address [AF_INET]192.168.0.100:1194: Cannot assign requested address
Thu Dec 15 16:01:23 2016 Exiting due to fatal error

Here is my config. One question I have is about the line:
push "dhcp-option DNS 192.168.2.1” # This should already match your router address and not need to be changed.
the pi's internal address is actually 192.168.0.100. I have tried switching the above line to that but it didn't seem to make any difference.
File: etc/openvpn/server.conf

local 192.168.0.100 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/piServer.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/piServer.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.100 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.2.1” # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

krzee

the client side seems to have a dns issue. try fixing that before starting openvpn

SomeGuy

Agree on DNS:

dig +short pi.myserver.com
(fails to resolve)

$ whois pi.myserver.com
...
   Domain Name: MYSERVER.COM
   Registrar: NETWORK SOLUTIONS, LLC.
...
   Name Server: NS1.OPS.NET
   Name Server: NS2.OPS.NET
...

$ dig @NS1.OPS.NET pi.myserver.com
dig @NS1.OPS.NET pi.myserver.com

$ whois OPS.NET
...
   Domain Name: OPS.NET
   Registrar: NETWORK SOLUTIONS, LLC.
...
   Name Server: NS1.V.CVH.JP
   Name Server: NS2.V.CVH.JP
...

$ dig @NS1.V.CVH.JP NS1.OPS.NET
(fails to find IP)
$ dig @NS1.V.CVH.JP NS1.OPS.NET
(fails to find IP)

$ dig +short NS1.V.CVH.JP
115.166.149.96
$ dig +short NS2.V.CVH.JP
52.69.37.230

Yeah, DNS issues.

After DNS is fixed, this one:

Thu Dec 15 16:01:23 2016 TCP/UDP: Socket bind failed on local address [AF_INET]192.168.0.100:1194: Cannot assign requested address

Suggests another service is bound to the port/ip (or all IP on same port.)

After DNS is working, check to see if another instance of openvpn or other service is running on the system occupying the same port.

for this, if your client (raspberrypi) is on linux, "lsof -i -n" (as root) is your friend.

$ grep 1194 /etc/services 
openvpn		1194/tcp
openvpn		1194/udp

Service name that "lsof -i -n" will report for port 1194 will be openvpn, so:

# lsof -i -n | grep ':openvpn'

and that should show you the PID and process names of anything else that is bound to using/listening on port 1194.

If you trying to run more than one copy of openvpn at the same time on the same system, that could lead to an error like that. (It is possible, but requires work with the configuration files.) If not, you may have a "stale" copy of openvpn still running, even if lockfiles do not exist for it. You should also confirm the 192.168.0.100 is actually on one of your local raspberry pi network interfaces.

# ip -4 addr show | grep 192.168.0.100

Any of these last item on the last error would be unrelated to the DNS issue, though. Fix DNS first, then see if other issue happens, and if so, find what is blocking access to bind to port.

krzee

ya the bind error is probably from openvpn already running

ifconfig 10.8.0.1 10.8.0.2 12
push "route 10.8.0.1 255.255.255.255"
push "route 192.168.0.100 255.255.255.0"
push "dhcp-option DNS 192.168.2.1”

remove all 4 of those lines.
also read about every config option that you use in the manual!

mflac

I’m sorry that I confused everyone. I thought that I was supposed to obscure my server name. the real name is pi.flacco.com
I can ssh and http to this address

$ dig +short pi.flacco.com
71.212.72.245

I made suggested changes to server.conf and rebooted.

root@raspberrypi:/home/pi# lsof -i -n | grep ':openvpn'
(no result)

root@raspberrypi:/home/pi# ip -4 addr show | grep 192.168.0.100
    inet 192.168.0.100/24 brd 192.168.0.255 scope global eth0

pi@raspberrypi:~ $ grep 1194 /etc/services
openvpn		1194/tcp
openvpn		1194/udp

root@raspberrypi:/home/pi# systemctl list-unit-files --type service | grep openvpn
openvpn.service                        enabled 
openvpn@.service                     enabled

my server.conf now is after removing the 4 suggested lines
local 192.168.0.100 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/piServer.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/piServer.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
##ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
##push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
##push "route 192.168.0.100 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
##push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
#push "dhcp-option DNS 192.168.0.1 # changed to this to test
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.

push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 3 however i still get

root@raspberrypi:/etc/openvpn/easy-rsa/keys# systemctl status openvpn
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
   Active: active (exited) since Mon 2016-12-19 12:22:26 PST; 24min ago
  Process: 738 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 738 (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/openvpn.service

Dec 19 12:22:25 raspberrypi systemd[1]: Starting OpenVPN service...
Dec 19 12:22:26 raspberrypi systemd[1]: Started OpenVPN service.

root@raspberrypi:/home/pi# systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN connection to server
   Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled)
   Active: failed (Result: exit-code) since Mon 2016-12-19 12:22:23 PST; 5min ago
  Process: 457 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf (code=exited, status=1/FAILURE)

Dec 19 12:22:23 raspberrypi systemd[1]: openvpn@server.service: control process exited, code=exited status=1
Dec 19 12:22:23 raspberrypi systemd[1]: Failed to start OpenVPN connection to server.
Dec 19 12:22:23 raspberrypi systemd[1]: Unit openvpn@server.service entered failed state.

SomeGuy

Thanks for including the details you have.

In your config , do you see this line?

log /var/log/openvpn.log

That describes the log file that the openvpn service is sending its details.

Also, see this line in your config:

verb 3

The general suggestion on these forums seems to advise users to set this to "4" when trying to diagnose issues and report logging problems.

Try stopping your openvpn service. Change the value in your config for "verb 3" to "verb 4" then restart your openvpn service, and once it does not connect, check the contents of the file "/var/log/openvpn.log" and report the contents of if from the date/time you restarted it *after* changing "verb 3" to "verb 4" -- that log file likely contains more useful information about connection issues.

Also, after you stop openvpn, before you restart it, try this as root:

lsof -i -n | grep ':openvpn'

Before restarting, it would be good to see if you have any other processes bound to this service port, blocking startup of openvpn.
(I did read you did it earlier, and reported the results that nothing else was listening, but it would be good to do this again when stopping it this time, before starting it again.)

mflac

I changed to verb 4 and rebooted to make sure.
then

root@raspberrypi:/etc/openvpn# systemctl stop openvpn
root@raspberrypi:/etc/openvpn# systemctl status openvpn
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
   Active: inactive (dead) since Mon 2016-12-19 21:45:32 PST; 6min ago
  Process: 736 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 736 (code=exited, status=0/SUCCESS)

Dec 19 18:54:27 raspberrypi systemd[1]: Started OpenVPN service.
Dec 19 21:45:32 raspberrypi systemd[1]: Stopping OpenVPN service...
Dec 19 21:45:32 raspberrypi systemd[1]: Stopped OpenVPN service.
Dec 19 21:51:28 raspberrypi systemd[1]: Stopped OpenVPN service.

I don't get any output from this:

root@raspberrypi:/etc/openvpn# lsof -i -n | grep ':openvpn'
root@raspberrypi:/etc/openvpn#

root@raspberrypi:/etc/openvpn/easy-rsa/keys# cat /var/log/openvpn.log
Options error: --tls-auth fails with '/etc/openvpn/easy-rsa/keys/ta.key': No such file or directory
Options error: Please correct these errors

I could swear I had this file previously. I will have to read up on this.

SomeGuy

mflac wrote

root@raspberrypi:/etc/openvpn/easy-rsa/keys# cat /var/log/openvpn.log
Options error: --tls-auth fails with '/etc/openvpn/easy-rsa/keys/ta.key': No such file or directory
Options error: Please correct these errors

I could swear I had this file previously. I will have to read up on this.

Yeah, that is a show-stopper. If you choose to use "tls-auth" and specify a key/file, do not forget to create it on the server and specify the "direction" and also make it available on the client and provide a direction for the client that is the complement of the direction on the server.

If you have this on the server:

tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0

Then you need to include the same file for clients and have the client config be:

tls-auth /path/to/client/copy/of/ta.key 1

A common method to avoid complications with locations on the filesystem for the ta.key (certs, ca, keys, etc) is to include them inline in the config file for clients.

Check the manpage for what can be included inline:

INLINE FILE SUPPORT
       OpenVPN allows including files in the main configuration for the  --ca,
       --cert,  --dh,  --extra-certs, --key, --pkcs12, --secret and --tls-auth
       options.

If you go the path of going with an inline "tls-auth" for the client in the client config, then consider also the need for using the option "key-direction". (From the man page:

       --key-direction
              Alternative  way  of specifying the optional direction parameter
              for the --tls-auth  and  --secret  options.  Useful  when  using
              inline files (See section on inline files).

So if server is using key direction of 0, and the client uses "tls-auth" as an inline file, then in the client config, you would add:

key-direction 1

Also, if you check and find the file is actually there, then consider a permission problem where the user starting openvpn does not have access to read these files. (Usually, on *nix, you start the service as "root" and then if there are config options to run as a different user, then after starting as root and loading all of the certs, and keys, then the service switches to run as a non-root user and group as you specified.)

mflac

So I created a .ta file
root@raspberrypi:/home/pi# la /etc/openvpn/easy-rsa/keys/ta.key
-rw------- 1 root root 636 Dec 19 22:10 /etc/openvpn/easy-rsa/keys/ta.key

I stop and restart openvpn. When I restart it, I don't get back to a prompt. I think that is because I am not restarting in daemon mode, but I don' know how to do that. If I open a new shell and look at the log, I don't see any errors, but I still get this

root@raspberrypi:/home/pi# systemctl status openvpn
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
   Active: inactive (dead) since Mon 2016-12-19 21:45:32 PST; 22h ago
  Process: 736 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 736 (code=exited, status=0/SUCCESS)

root@raspberrypi:/home/pi# systemctl stop openvpn

root@raspberrypi:/home/pi# systemctl status openvpn
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
   Active: inactive (dead) since Mon 2016-12-19 21:45:32 PST; 22h ago
  Process: 736 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 736 (code=exited, status=0/SUCCESS)

root@raspberrypi:/home/pi# openvpn --config /etc/openvpn/server.conf

hangs-> ctrl-c

root@raspberrypi:/home/pi# cat /var/log/openvpn.log
Tue Dec 20 20:17:32 2016 us=495357 Current Parameter Settings:
Tue Dec 20 20:17:32 2016 us=495679   config = '/etc/openvpn/server.conf'
Tue Dec 20 20:17:32 2016 us=495713   mode = 1
Tue Dec 20 20:17:32 2016 us=495743   persist_config = DISABLED
Tue Dec 20 20:17:32 2016 us=495772   persist_mode = 1
Tue Dec 20 20:17:32 2016 us=495801   show_ciphers = DISABLED
Tue Dec 20 20:17:32 2016 us=495829   show_digests = DISABLED
Tue Dec 20 20:17:32 2016 us=495857   show_engines = DISABLED
Tue Dec 20 20:17:32 2016 us=495885   genkey = DISABLED
Tue Dec 20 20:17:32 2016 us=495913   key_pass_file = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=495942   show_tls_ciphers = DISABLED
Tue Dec 20 20:17:32 2016 us=495970 Connection profiles [default]:
Tue Dec 20 20:17:32 2016 us=496000   proto = udp
Tue Dec 20 20:17:32 2016 us=496028   local = '192.168.0.100'
Tue Dec 20 20:17:32 2016 us=496056   local_port = 1194
Tue Dec 20 20:17:32 2016 us=496084   remote = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=496113   remote_port = 1194
Tue Dec 20 20:17:32 2016 us=496141   remote_float = DISABLED
Tue Dec 20 20:17:32 2016 us=496168   bind_defined = DISABLED
Tue Dec 20 20:17:32 2016 us=496196   bind_local = ENABLED
Tue Dec 20 20:17:32 2016 us=496225   connect_retry_seconds = 5
Tue Dec 20 20:17:32 2016 us=496253   connect_timeout = 10
Tue Dec 20 20:17:32 2016 us=496280   connect_retry_max = 0
Tue Dec 20 20:17:32 2016 us=496308   socks_proxy_server = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=496336   socks_proxy_port = 0
Tue Dec 20 20:17:32 2016 us=496364   socks_proxy_retry = DISABLED
Tue Dec 20 20:17:32 2016 us=496393   tun_mtu = 1500
Tue Dec 20 20:17:32 2016 us=496421   tun_mtu_defined = ENABLED
Tue Dec 20 20:17:32 2016 us=496449   link_mtu = 1500
Tue Dec 20 20:17:32 2016 us=496477   link_mtu_defined = DISABLED
Tue Dec 20 20:17:32 2016 us=496505   tun_mtu_extra = 0
Tue Dec 20 20:17:32 2016 us=496533   tun_mtu_extra_defined = DISABLED
Tue Dec 20 20:17:32 2016 us=496561   mtu_discover_type = -1
Tue Dec 20 20:17:32 2016 us=496589   fragment = 0
Tue Dec 20 20:17:32 2016 us=496617   mssfix = 1450
Tue Dec 20 20:17:32 2016 us=496645   explicit_exit_notification = 0
Tue Dec 20 20:17:32 2016 us=496673 Connection profiles END
Tue Dec 20 20:17:32 2016 us=496701   remote_random = DISABLED
Tue Dec 20 20:17:32 2016 us=496729   ipchange = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=496756   dev = 'tun'
Tue Dec 20 20:17:32 2016 us=496784   dev_type = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=496812   dev_node = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=496839   lladdr = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=496868   topology = 1
Tue Dec 20 20:17:32 2016 us=496895   tun_ipv6 = DISABLED
Tue Dec 20 20:17:32 2016 us=496923   ifconfig_local = '10.8.0.1'
Tue Dec 20 20:17:32 2016 us=496952   ifconfig_remote_netmask = '10.8.0.2'
Tue Dec 20 20:17:32 2016 us=496980   ifconfig_noexec = DISABLED
Tue Dec 20 20:17:32 2016 us=497008   ifconfig_nowarn = DISABLED
Tue Dec 20 20:17:32 2016 us=497036   ifconfig_ipv6_local = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497065   ifconfig_ipv6_netbits = 0
Tue Dec 20 20:17:32 2016 us=497092   ifconfig_ipv6_remote = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497121   shaper = 0
Tue Dec 20 20:17:32 2016 us=497149   mtu_test = 0
Tue Dec 20 20:17:32 2016 us=497176   mlock = DISABLED
Tue Dec 20 20:17:32 2016 us=497204   keepalive_ping = 10
Tue Dec 20 20:17:32 2016 us=497232   keepalive_timeout = 120
Tue Dec 20 20:17:32 2016 us=497260   inactivity_timeout = 0
Tue Dec 20 20:17:32 2016 us=497288   ping_send_timeout = 10
Tue Dec 20 20:17:32 2016 us=497316   ping_rec_timeout = 240
Tue Dec 20 20:17:32 2016 us=497344   ping_rec_timeout_action = 2
Tue Dec 20 20:17:32 2016 us=497372   ping_timer_remote = DISABLED
Tue Dec 20 20:17:32 2016 us=497401   remap_sigusr1 = 0
Tue Dec 20 20:17:32 2016 us=497428   persist_tun = ENABLED
Tue Dec 20 20:17:32 2016 us=497456   persist_local_ip = DISABLED
Tue Dec 20 20:17:32 2016 us=497484   persist_remote_ip = DISABLED
Tue Dec 20 20:17:32 2016 us=497512   persist_key = ENABLED
Tue Dec 20 20:17:32 2016 us=497540   passtos = DISABLED
Tue Dec 20 20:17:32 2016 us=497568   resolve_retry_seconds = 1000000000
Tue Dec 20 20:17:32 2016 us=497610   username = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497638   groupname = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497667   chroot_dir = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497694   cd_dir = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497722   writepid = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497750   up_script = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497777   down_script = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=497805   down_pre = DISABLED
Tue Dec 20 20:17:32 2016 us=497833   up_restart = DISABLED
Tue Dec 20 20:17:32 2016 us=497861   up_delay = DISABLED
Tue Dec 20 20:17:32 2016 us=497889   daemon = DISABLED
Tue Dec 20 20:17:32 2016 us=497917   inetd = 0
Tue Dec 20 20:17:32 2016 us=497945   log = ENABLED
Tue Dec 20 20:17:32 2016 us=497972   suppress_timestamps = DISABLED
Tue Dec 20 20:17:32 2016 us=498001   nice = 0
Tue Dec 20 20:17:32 2016 us=498029   verbosity = 4
Tue Dec 20 20:17:32 2016 us=498057   mute = 0
Tue Dec 20 20:17:32 2016 us=498085   gremlin = 0
Tue Dec 20 20:17:32 2016 us=498113   status_file = '/var/log/openvpn-status.log'
Tue Dec 20 20:17:32 2016 us=498142   status_file_version = 1
Tue Dec 20 20:17:32 2016 us=498170   status_file_update_freq = 20
Tue Dec 20 20:17:32 2016 us=498198   occ = ENABLED
Tue Dec 20 20:17:32 2016 us=498226   rcvbuf = 65536
Tue Dec 20 20:17:32 2016 us=498254   sndbuf = 65536
Tue Dec 20 20:17:32 2016 us=498282   mark = 0
Tue Dec 20 20:17:32 2016 us=498310   sockflags = 0
Tue Dec 20 20:17:32 2016 us=498338   fast_io = DISABLED
Tue Dec 20 20:17:32 2016 us=498366   lzo = 7
Tue Dec 20 20:17:32 2016 us=498394   route_script = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=498422   route_default_gateway = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=498450   route_default_metric = 0
Tue Dec 20 20:17:32 2016 us=498479   route_noexec = DISABLED
Tue Dec 20 20:17:32 2016 us=498508   route_delay = 0
Tue Dec 20 20:17:32 2016 us=498537   route_delay_window = 30
Tue Dec 20 20:17:32 2016 us=498565   route_delay_defined = DISABLED
Tue Dec 20 20:17:32 2016 us=498594   route_nopull = DISABLED
Tue Dec 20 20:17:32 2016 us=498623   route_gateway_via_dhcp = DISABLED
Tue Dec 20 20:17:32 2016 us=498652   max_routes = 100
Tue Dec 20 20:17:32 2016 us=498681   allow_pull_fqdn = DISABLED
Tue Dec 20 20:17:32 2016 us=498711   route 10.8.0.0/255.255.255.0/nil/nil
Tue Dec 20 20:17:32 2016 us=498741   management_addr = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=498770   management_port = 0
Tue Dec 20 20:17:32 2016 us=498798   management_user_pass = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=498827   management_log_history_cache = 250
Tue Dec 20 20:17:32 2016 us=498856   management_echo_buffer_size = 100
Tue Dec 20 20:17:32 2016 us=498885   management_write_peer_info_file = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=498914   management_client_user = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=498943   management_client_group = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=498972   management_flags = 0
Tue Dec 20 20:17:32 2016 us=499001   shared_secret_file = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499030   key_direction = 1
Tue Dec 20 20:17:32 2016 us=499059   ciphername_defined = ENABLED
Tue Dec 20 20:17:32 2016 us=499088   ciphername = 'AES-128-CBC'
Tue Dec 20 20:17:32 2016 us=499117   authname_defined = ENABLED
Tue Dec 20 20:17:32 2016 us=499145   authname = 'SHA1'
Tue Dec 20 20:17:32 2016 us=499172   prng_hash = 'SHA1'
Tue Dec 20 20:17:32 2016 us=499201   prng_nonce_secret_len = 16
Tue Dec 20 20:17:32 2016 us=499230   keysize = 0
Tue Dec 20 20:17:32 2016 us=499258   engine = DISABLED
Tue Dec 20 20:17:32 2016 us=499286   replay = ENABLED
Tue Dec 20 20:17:32 2016 us=499314   mute_replay_warnings = DISABLED
Tue Dec 20 20:17:32 2016 us=499343   replay_window = 64
Tue Dec 20 20:17:32 2016 us=499372   replay_time = 15
Tue Dec 20 20:17:32 2016 us=499400   packet_id_file = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499429   use_iv = ENABLED
Tue Dec 20 20:17:32 2016 us=499457   test_crypto = DISABLED
Tue Dec 20 20:17:32 2016 us=499485   tls_server = ENABLED
Tue Dec 20 20:17:32 2016 us=499513   tls_client = DISABLED
Tue Dec 20 20:17:32 2016 us=499555   key_method = 2
Tue Dec 20 20:17:32 2016 us=499584   ca_file = '/etc/openvpn/easy-rsa/keys/ca.crt'
Tue Dec 20 20:17:32 2016 us=499613   ca_path = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499642   dh_file = '/etc/openvpn/easy-rsa/keys/dh2048.pem'
Tue Dec 20 20:17:32 2016 us=499672   cert_file = '/etc/openvpn/easy-rsa/keys/vpn-server.crt'
Tue Dec 20 20:17:32 2016 us=499701   priv_key_file = '/etc/openvpn/easy-rsa/keys/vpn-server.key'
Tue Dec 20 20:17:32 2016 us=499730   pkcs12_file = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499759   cipher_list = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499788   tls_verify = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499816   tls_export_cert = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499845   verify_x509_type = 0
Tue Dec 20 20:17:32 2016 us=499873   verify_x509_name = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499902   crl_file = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=499930   ns_cert_type = 0
Tue Dec 20 20:17:32 2016 us=499959   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=499987   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500016   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500044   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500072   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500101   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500129   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500157   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500185   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500214   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500242   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500270   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500299   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500327   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500355   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500384   remote_cert_ku[i] = 0
Tue Dec 20 20:17:32 2016 us=500412   remote_cert_eku = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=500441   ssl_flags = 0
Tue Dec 20 20:17:32 2016 us=500469   tls_timeout = 2
Tue Dec 20 20:17:32 2016 us=500497   renegotiate_bytes = 0
Tue Dec 20 20:17:32 2016 us=500525   renegotiate_packets = 0
Tue Dec 20 20:17:32 2016 us=500554   renegotiate_seconds = 3600
Tue Dec 20 20:17:32 2016 us=500582   handshake_window = 60
Tue Dec 20 20:17:32 2016 us=500611   transition_window = 3600
Tue Dec 20 20:17:32 2016 us=500639   single_session = DISABLED
Tue Dec 20 20:17:32 2016 us=500667   push_peer_info = DISABLED
Tue Dec 20 20:17:32 2016 us=500694   tls_exit = DISABLED
Tue Dec 20 20:17:32 2016 us=500723   tls_auth_file = '/etc/openvpn/easy-rsa/keys/ta.key'
Tue Dec 20 20:17:32 2016 us=500752   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500781   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500809   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500838   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500867   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500896   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500924   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500953   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=500981   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501010   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501039   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501068   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501096   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501125   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501154   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501187   pkcs11_protected_authentication = DISABLED
Tue Dec 20 20:17:32 2016 us=501218   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501248   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501277   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501318   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501348   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501378   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501407   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501437   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501466   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501496   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501525   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501554   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501636   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501668   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501697   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501726   pkcs11_private_mode = 00000000
Tue Dec 20 20:17:32 2016 us=501755   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501784   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501812   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501841   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501870   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501898   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501927   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501956   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=501984   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502013   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502041   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502069   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502098   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502126   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502155   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502183   pkcs11_cert_private = DISABLED
Tue Dec 20 20:17:32 2016 us=502212   pkcs11_pin_cache_period = -1
Tue Dec 20 20:17:32 2016 us=502241   pkcs11_id = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=502269   pkcs11_id_management = DISABLED
Tue Dec 20 20:17:32 2016 us=502306   server_network = 10.8.0.0
Tue Dec 20 20:17:32 2016 us=502339   server_netmask = 255.255.255.0
Tue Dec 20 20:17:32 2016 us=502373   server_network_ipv6 = ::
Tue Dec 20 20:17:32 2016 us=502402   server_netbits_ipv6 = 0
Tue Dec 20 20:17:32 2016 us=502434   server_bridge_ip = 0.0.0.0
Tue Dec 20 20:17:32 2016 us=502466   server_bridge_netmask = 0.0.0.0
Tue Dec 20 20:17:32 2016 us=502498   server_bridge_pool_start = 0.0.0.0
Tue Dec 20 20:17:32 2016 us=502530   server_bridge_pool_end = 0.0.0.0
Tue Dec 20 20:17:32 2016 us=502559   push_entry = 'route 10.8.0.0 255.255.255.0'
Tue Dec 20 20:17:32 2016 us=502588   push_entry = 'redirect-gateway def1'
Tue Dec 20 20:17:32 2016 us=502616   push_entry = 'route 10.8.0.0 255.255.255.0'
Tue Dec 20 20:17:32 2016 us=502645   push_entry = 'topology net30'
Tue Dec 20 20:17:32 2016 us=502673   push_entry = 'ping 10'
Tue Dec 20 20:17:32 2016 us=502702   push_entry = 'ping-restart 120'
Tue Dec 20 20:17:32 2016 us=502730   ifconfig_pool_defined = ENABLED
Tue Dec 20 20:17:32 2016 us=502762   ifconfig_pool_start = 10.8.0.4
Tue Dec 20 20:17:32 2016 us=502794   ifconfig_pool_end = 10.8.0.251
Tue Dec 20 20:17:32 2016 us=502826   ifconfig_pool_netmask = 0.0.0.0
Tue Dec 20 20:17:32 2016 us=502855   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=502884   ifconfig_pool_persist_refresh_freq = 600
Tue Dec 20 20:17:32 2016 us=502913   ifconfig_ipv6_pool_defined = DISABLED
Tue Dec 20 20:17:32 2016 us=502943   ifconfig_ipv6_pool_base = ::
Tue Dec 20 20:17:32 2016 us=502972   ifconfig_ipv6_pool_netbits = 0
Tue Dec 20 20:17:32 2016 us=503001   n_bcast_buf = 256
Tue Dec 20 20:17:32 2016 us=503029   tcp_queue_limit = 64
Tue Dec 20 20:17:32 2016 us=503057   real_hash_size = 256
Tue Dec 20 20:17:32 2016 us=503085   virtual_hash_size = 256
Tue Dec 20 20:17:32 2016 us=503114   client_connect_script = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=503154   learn_address_script = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=503184   client_disconnect_script = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=503213   client_config_dir = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=503241   ccd_exclusive = DISABLED
Tue Dec 20 20:17:32 2016 us=503270   tmp_dir = '/tmp'
Tue Dec 20 20:17:32 2016 us=503298   push_ifconfig_defined = DISABLED
Tue Dec 20 20:17:32 2016 us=503334   push_ifconfig_local = 0.0.0.0
Tue Dec 20 20:17:32 2016 us=503367   push_ifconfig_remote_netmask = 0.0.0.0
Tue Dec 20 20:17:32 2016 us=503396   push_ifconfig_ipv6_defined = DISABLED
Tue Dec 20 20:17:32 2016 us=503427   push_ifconfig_ipv6_local = ::/0
Tue Dec 20 20:17:32 2016 us=503458   push_ifconfig_ipv6_remote = ::
Tue Dec 20 20:17:32 2016 us=503487   enable_c2c = ENABLED
Tue Dec 20 20:17:32 2016 us=503515   duplicate_cn = ENABLED
Tue Dec 20 20:17:32 2016 us=503543   cf_max = 0
Tue Dec 20 20:17:32 2016 us=503571   cf_per = 0
Tue Dec 20 20:17:32 2016 us=503599   max_clients = 1024
Tue Dec 20 20:17:32 2016 us=503627   max_routes_per_client = 256
Tue Dec 20 20:17:32 2016 us=503655   auth_user_pass_verify_script = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=503684   auth_user_pass_verify_script_via_file = DISABLED
Tue Dec 20 20:17:32 2016 us=503713   port_share_host = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=503741   port_share_port = 0
Tue Dec 20 20:17:32 2016 us=503769   client = DISABLED
Tue Dec 20 20:17:32 2016 us=503797   pull = DISABLED
Tue Dec 20 20:17:32 2016 us=503825   auth_user_pass_file = '[UNDEF]'
Tue Dec 20 20:17:32 2016 us=503857 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016
Tue Dec 20 20:17:32 2016 us=503909 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Tue Dec 20 20:17:32 2016 us=504458 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue Dec 20 20:17:32 2016 us=505599 Diffie-Hellman initialized with 2048 bit key
Tue Dec 20 20:17:32 2016 us=506841 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Tue Dec 20 20:17:32 2016 us=506893 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 20 20:17:32 2016 us=506931 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 20 20:17:32 2016 us=506973 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Dec 20 20:17:32 2016 us=507032 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Dec 20 20:17:32 2016 us=507319 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:8f:b8:8c
Tue Dec 20 20:17:32 2016 us=508346 TUN/TAP device tun0 opened
Tue Dec 20 20:17:32 2016 us=508453 TUN/TAP TX queue length set to 100
Tue Dec 20 20:17:32 2016 us=508536 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Dec 20 20:17:32 2016 us=508649 /sbin/ip link set dev tun0 up mtu 1500
Tue Dec 20 20:17:32 2016 us=517166 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Tue Dec 20 20:17:32 2016 us=521500 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Tue Dec 20 20:17:32 2016 us=524810 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Dec 20 20:17:32 2016 us=524923 UDPv4 link local (bound): [AF_INET]192.168.0.100:1194
Tue Dec 20 20:17:32 2016 us=524956 UDPv4 link remote: [undef]
Tue Dec 20 20:17:32 2016 us=524997 MULTI: multi_init called, r=256 v=256
Tue Dec 20 20:17:32 2016 us=525089 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Dec 20 20:17:32 2016 us=525164 Initialization Sequence Completed

SomeGuy

The log makes it look like your openvpn server did start up and get running. That looks like good news. :-)

As for the start from the command-line... Your attempt to start it in the "foreground" can be changed to "damonize" it with the openvpn option --daemon from the command-line, but you may want to add other args to more closely approximate how it might be called by your system, and see why the system start might be having problems.

If you wanted it to be damonized from the command-line, based on what you have described, and a few assumptions, you could try this as root from the command-line:

/usr/sbin/openvpn --daemon server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf

However, you may actually have a working setup for openvpn as a server right now, because this line from your log is a good sign:

Tue Dec 20 20:17:32 2016 us=525164 Initialization Sequence Completed

Check this directory for files that end with ".conf":

ls -l /etc/openvpn/*.conf

Make sure the only file that ends with ".conf" is the "server.conf" (each *.conf file in that directory will likely be treated as a separate config for a separate service. Limit this to only one "*.conf" file in that directory while troubleshooting. If you want to run a server and a client on the same device, why not work on one at a time until each is working as you want?) You do not have to delete all of the other files that end in *.conf in this directory -- you can just rename all *.conf files except for "server.conf" to other names like *.conf.DISABLED, for example, leaving just "server.conf" as the only *.conf file in that directory.)

Once there is only the one "/etc/openvpn/server.conf" , maybe review your permissions and ownership of files:

(Make all 4 files owned by user "root", group "root" and then set the two "private" files to be "read-only" by just user "root" and the certs to be readable by everyone. Some service/init-scripts related to security will check the permissions of files and refuse to run if their private files are too permissive. Let's avoid that problem:)

chown root:root /etc/openvpn/server.conf /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/piServer.crt /etc/openvpn/easy-rsa/keys/piServer.key /etc/openvpn/easy-rsa/keys/dh2048.pem /etc/openvpn/easy-rsa/keys /etc/openvpn/easy-rsa/keys/ta.key
chmod 400 /etc/openvpn/easy-rsa/keys/piServer.key /etc/openvpn/easy-rsa/keys/dh2048.pem /etc/openvpn/easy-rsa/keys/ta.key
chmod 644 /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/piServer.crt /etc/openvpn/server.conf
chmod 751 /etc/openvpn/easy-rsa/keys

Once that is all done, why not try restarting openvpn and run this as root?

systemctl restart openvpn

Then, watch the end of the log file creates by the vpn server with this:

tail -f /var/log/openvpn.log

(With that "tail -f" command, it will watch the tail end of that OpenVPN log file and as data is written to the end of the file, check the file for updates and then relay that same information to your screen. When you are ready to "exit" out of the "tail of" just press and hold "control" and then press the "c" character (control-c).)

When you tail that log file, if you see something like this line again (see below), then press control-c and try getting a client to use that OpenVPN server you have running:

Tue Dec 20 20:17:32 2016 us=525164 Initialization Sequence Completed

After you press "control-c" to exit the "tail -f" you can check to see that openvpn is still running:

ps auxwww | grep -i openvpn

Good progress! :-)

The last part to getting the server running appears to just be the part where you call systemctl and have the service abide by your request to start and that may be working once you make sure there is only one *.conf in the /etc/openvpn/ dir and fix ownership and permissions of files.

SomeGuy

One more thing, assuming your configuration file is called "server.conf" and it is in /etc/openvpn/, then try this, instead for service checks:

bash
systemctl stop openvpn
systemctl stop openvpn@server
ps auxwwww | grep -v grep | egrep 'openvpn.*.conf' >> /dev/null 2>&1 || echo "No openvpn found running"

If openvpn is really not running, then try restarting based on the "template" to the service by using the config file name (like above, "server"):

systemctl start openvpn@server

Check to see the status of that service:

systemctl status openvpn@server

If that works as expected, again, the next step would be trying to get a client to connect to that server.

mflac

I followed all the steps you suggested:

root@raspberrypi:/home/pi# systemctl restart openvpn

root@raspberrypi:/home/pi# tail -f /var/log/openvpn.log
Wed Dec 21 20:52:48 2016 us=897543 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Dec 21 20:52:48 2016 us=897675 /sbin/ip link set dev tun0 up mtu 1500
Wed Dec 21 20:52:48 2016 us=903890 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Wed Dec 21 20:52:48 2016 us=915601 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Wed Dec 21 20:52:48 2016 us=926818 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Dec 21 20:52:48 2016 us=927951 UDPv4 link local (bound): [AF_INET]192.168.0.100:1194
Wed Dec 21 20:52:48 2016 us=928082 UDPv4 link remote: [undef]
Wed Dec 21 20:52:48 2016 us=928121 MULTI: multi_init called, r=256 v=256
Wed Dec 21 20:52:48 2016 us=928357 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Dec 21 20:52:48 2016 us=928439 Initialization Sequence Completed
^C

root@raspberrypi:/home/pi# ps auxwww | grep -i openvpn
root      3756  0.0  0.1   5112  1780 ?        Ss   20:52   0:00 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf
root      3788  0.0  0.2   4276  2008 pts/0    S+   20:54   0:00 grep -i openvpn

root@raspberrypi:/home/pi# systemctl status openvpn
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
   Active: active (exited) since Wed 2016-12-21 20:52:48 PST; 1min 51s ago
  Process: 3741 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 3741 (code=exited, status=0/SUCCESS)
Dec 21 20:52:48 raspberrypi systemd[1]: Started OpenVPN service.

root@raspberrypi:/etc/openvpn# systemctl status openvpn@server
● openvpn@server.service - OpenVPN connection to server
   Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled)
   Active: active (running) since Wed 2016-12-21 20:52:48 PST; 35min ago
  Process: 3739 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf (code=exited, status=0/SUCCESS)
 Main PID: 3756 (openvpn)
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─3756 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/o...

Dec 21 20:52:48 raspberrypi systemd[1]: Started OpenVPN connection to server.
Dec 21 21:27:36 raspberrypi systemd[1]: Started OpenVPN connection to server.

root@raspberrypi:/etc/openvpn# systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN connection to server
   Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled)
   Active: active (running) since Wed 2016-12-21 20:52:48 PST; 39min ago
  Process: 3739 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf (code=exited, status=0/SUCCESS)
 Main PID: 3756 (openvpn)
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─3756 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/o...

Dec 21 20:52:48 raspberrypi systemd[1]: Started OpenVPN connection to server.
Dec 21 21:27:36 raspberrypi systemd[1]: Started OpenVPN connection to server.

I've never gotten these last three to run successfully!!!
Tomorrow, I will try to re-setup the client and see if I can connect.
I have a lot of reading to do, to really understand all the commands you have shown me.
Thank you for all your help thus far. I only realize now how far over my head I was, when I started this.

SomeGuy

mflac wroteI followed all the steps you suggested:

root@raspberrypi:/home/pi# systemctl restart openvpn

root@raspberrypi:/home/pi# tail -f /var/log/openvpn.log
Wed Dec 21 20:52:48 2016 us=897543 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Dec 21 20:52:48 2016 us=897675 /sbin/ip link set dev tun0 up mtu 1500
Wed Dec 21 20:52:48 2016 us=903890 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Wed Dec 21 20:52:48 2016 us=915601 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Wed Dec 21 20:52:48 2016 us=926818 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Dec 21 20:52:48 2016 us=927951 UDPv4 link local (bound): [AF_INET]192.168.0.100:1194
Wed Dec 21 20:52:48 2016 us=928082 UDPv4 link remote: [undef]
Wed Dec 21 20:52:48 2016 us=928121 MULTI: multi_init called, r=256 v=256
Wed Dec 21 20:52:48 2016 us=928357 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Dec 21 20:52:48 2016 us=928439 Initialization Sequence Completed
^C

That worked.

root@raspberrypi:/home/pi# ps auxwww | grep -i openvpn
root      3756  0.0  0.1   5112  1780 ?        Ss   20:52   0:00 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf
root      3788  0.0  0.2   4276  2008 pts/0    S+   20:54   0:00 grep -i openvpn

Yep, it is running! :-)

root@raspberrypi:/home/pi# systemctl status openvpn
● openvpn.service - OpenVPN service
   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
   Active: active (exited) since Wed 2016-12-21 20:52:48 PST; 1min 51s ago
  Process: 3741 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
 Main PID: 3741 (code=exited, status=0/SUCCESS)
Dec 21 20:52:48 raspberrypi systemd[1]: Started OpenVPN service.

root@raspberrypi:/etc/openvpn# systemctl status openvpn@server
● openvpn@server.service - OpenVPN connection to server
   Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled)
   Active: active (running) since Wed 2016-12-21 20:52:48 PST; 35min ago
  Process: 3739 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf (code=exited, status=0/SUCCESS)
 Main PID: 3756 (openvpn)
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─3756 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/o...

Dec 21 20:52:48 raspberrypi systemd[1]: Started OpenVPN connection to server.
Dec 21 21:27:36 raspberrypi systemd[1]: Started OpenVPN connection to server.

root@raspberrypi:/etc/openvpn# systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN connection to server
   Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled)
   Active: active (running) since Wed 2016-12-21 20:52:48 PST; 39min ago
  Process: 3739 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf (code=exited, status=0/SUCCESS)
 Main PID: 3756 (openvpn)
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─3756 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/o...

Dec 21 20:52:48 raspberrypi systemd[1]: Started OpenVPN connection to server.
Dec 21 21:27:36 raspberrypi systemd[1]: Started OpenVPN connection to server.

The init script is working as it should, and the "templated" call/check for the specific openvpn config "server" is shows it is running.

I've never gotten these last three to run successfully!!!
Tomorrow, I will try to re-setup the client and see if I can connect.
I have a lot of reading to do, to really understand all the commands you have shown me.
Thank you for all your help thus far. I only realize now how far over my head I was, when I started this.

Congrats on starting your first OpenVPN Server! :-)

When you are next ready, using the experience you have now, you can take on the task of:
* Building a key for your client, with a cert (left for you to do on your own)
* Build a config with all of the files required, based on your server config: (CLIENT_NAME.crt, CLIENT_NAME.key, "CA_NAME.crt", "ta.key", and then the config file itself: CLIENT_NAME.(ovpn or .conf : a client config to be run on *NIX will probably work best with the extension ".conf" while a client config for Windows or Android would probably work better with the extension ".ovpn")
* Install the OpenVPN service on your target device (If MS Windows, then one of these: https://openvpn.net/index.php/download/community-downloads.html , and if Android, I suggest "OpenVPN for Android" (by Arne Schwabe) https://play.google.com/store/apps/details?id=de.blinkt.openvpn , and if Linux, the commonly available packaged OpenVPN package from your distro.
* Place your fles in the "config" directory for OpenVPN (window or linux) , or copy them to your android device and import them.

It is probably a bad idea to test a client on the same machine as the OpenVPN server (even for testing.)

That is it. Your experience with linux so far might make installing a linux client easier, and once you have experience with that, configs for other OS. if you have no other linux machines to be clients, then the next best client might be the Android app: you can import a "basic" config with the 4 other files (key, cert, ca, ta.key) and the conf imported, many GUI-based config features will make it easy to change many settings to "make it work" and then once you have a working config for a client on Android using "OpenVPN for Android" there is an option in the "edit view" of a config to "Generate Config" which allows you to export a text file with all of the config options that made it work for Android. That may help you with Windows or other OS, too.

Try your hand at building a client config on your own. If you succeed , then return-back with your working client config (with secret and identifiable information removed) and paste it into a post in this thread; this may help other people trying to do the same thing as you.

I am guessing your experience so far setting up a server will make setting up your client much easier than the effort you invested in making a server config.

mflac

Well... a few steps forward, a few steps backwards.

I created the client key, cert, ta.key ,dh2048.pem, and the 3des.key. I then created the opvn file with this script from Jodoinhttps://gist.github.com/laurenorsini/10013430 and loaded it in the iPhone opvn app.

client
dev tun
proto udp
remote <pi.flacco.com> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
<ca>
-----BEGIN CERTIFICATE-----
(redacted)

-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
(redacted)
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info:
(redacted)
-----END RSA PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----

-----END OpenVPN Static key V1-----
</tls-auth>
Alas,when trying to connect from the client (from outside the home network), I get the following error:
Transport Error: DNS resolve error on '<pi.flacco.com>' for UDP session: Host not found (authoritative)

Alas I get the following error:
Transport Error: DNS resolve error on '<pi.flacco.com>' for UDP session: Host not found (authoritative)

I have the appropriate ports forwarded on y modem/router:
LAN IP Protocol Ports Forwarded Remote Ports Remote Defined
192.168.0.100 TCP/UDP 22 N/A N/A
192.168.0.100 UDP 1194 N/A N/A
192.168.0.100 TCP 80 N/A N/A

The server side seems to be working

root@raspberrypi:/home/pi# ps auxwww | grep -i openvpn
root     15909  0.0  0.1   4276  1816 pts/0    S+   07:47   0:00 grep -i openvpn
root     31947  0.0  0.1   5112  1800 ?        Ss   Dec24   0:01 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf

but then:

$ sudo nmap -sU localhost -p 1194
Starting Nmap 6.47 ( http://nmap.org ) at 2016-12-25 11:59 PST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00016s latency).
Other addresses for localhost (not scanned): 127.0.0.1
PORT     STATE  SERVICE
1194/udp closed openvpn

sudo tail -100 /var/log/openvpn.log
Sun Dec 25 12:04:44 2016 us=881659 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Sun Dec 25 12:04:44 2016 us=892707 Diffie-Hellman initialized with 2048 bit key
Sun Dec 25 12:04:44 2016 us=909099 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Sun Dec 25 12:04:44 2016 us=909265 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Dec 25 12:04:44 2016 us=909308 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Dec 25 12:04:44 2016 us=909356 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Dec 25 12:04:44 2016 us=909409 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Dec 25 12:04:44 2016 us=909482 TCP/UDP: Socket bind failed on local address [AF_INET]192.168.0.100:1194: Cannot assign requested address
Sun Dec 25 12:04:44 2016 us=909519 Exiting due to fatal error

I wasn't getting this error before, I'm not sure why I'm getting it now.

[oconf= /etc/openvpn/server.conf]local 192.168.0.100 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/vpn-server.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/vpn-server.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
##ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
##push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
##push "route 192.168.0.100 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
##push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
#push "dhcp-option DNS 192.168.0.1 # changed to this to test
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.

push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
#user nobody
#group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 4[/oconf]

SomeGuy

Your process check (on the server, right?) says:

root@raspberrypi:/home/pi# ps auxwww | grep -i openvpn
root     15909  0.0  0.1   4276  1816 pts/0    S+   07:47   0:00 grep -i openvpn
root     31947  0.0  0.1   5112  1800 ?        Ss   Dec24   0:01 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf

That OpenVPN is running on the server and has a start time of December 24, so it is running.

Assuming your "server.conf" is in "/etc/openvpn/" please do this:

ls -l /etc/openvpn/*.conf

Is the only file shown "server.conf" ?
If not, please move any other openvpn conf files on the server in "/etc/openv" to some our dir or some other filenames that do not end in ".conf"

Make sure the only *.conf file in /etc/openvpn/ is just the "server.conf" while we are testing.

Hold off on this "error" for now. There are a few possible ways to create this error, but I do not think this is related to the DNS issue. As for nmap, read later in this reply.

Sun Dec 25 12:04:44 2016 us=909482 TCP/UDP: Socket bind failed on local address [AF_INET]192.168.0.100:1194: Cannot assign requested address
Sun Dec 25 12:04:44 2016 us=909519 Exiting due to fatal error

Your "server.conf" includes this line:

local 192.168.0.100

That line in the config says to only use the interface that has that IP and only use that IP to listen with service, which elsewhere in the config is specifici to be UDP and port 1194.

Your use of nmap to connect to "localhost" (127.0.0.1) is not the same IP address you asked your service to listen to. If you want to test from the server running OpenVPN service for network availability, then on the OpenVPN server, nmap to "192.168.0.100" not "127.0.0.1"

Alas,when trying to connect from the client (from outside the home network), I get the following error:
Transport Error: DNS resolve error on '<pi.flacco.com>' for UDP session: Host not found (authoritative)

Alas I get the following error:
Transport Error: DNS resolve error on '<pi.flacco.com>' for UDP session: Host not found (authoritative)

This error is specific to DNS.

Why not , as a diagnostic step, alter your client config and replace the server name with an IP address?

I have the appropriate ports forwarded on y modem/router:
LAN IP Protocol Ports Forwarded Remote Ports Remote Defined
192.168.0.100 TCP/UDP 22 N/A N/A
192.168.0.100 UDP 1194 N/A N/A
192.168.0.100 TCP 80 N/A N/A

This may be useful later, but for now, the first client error you report (DNS) means your client was not even able to get to the step of testing your expected forwarding rules.

Your next step: Diagnose the DNS resolution issue on the client side, or as a diagnostic step bypass DNS with an IP address.

In your client config, change this line:

remote <pi.flacco.com> 1194

to:

remote PUBLIC.IPv4.ADDRESS.HERE 1194

(Replacing the text "PUBLIC.IPv4.ADDRESS.HERE" with the actual public IP address that has forwarding enabled for UDP/1194 to your server running OpenVPN on UDP/1194.)

If you find the client works with an IP address, but fails with the name, then there really is just a DNS issue.

What does this test show you on the client? (bypassing DNS by using an IP address in the client config instead.)

mflac

I ran this (on the raspberry server)

[root] pi# ps auxwww | grep -i openvpn
root      6172  0.0  0.2   4276  1940 pts/1    S+   09:07   0:00 grep -i openvpn

No daemon!!! So I ran the command you had showed me earlier:

[root] pi# /usr/sbin/openvpn --daemon server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf

[root] pi# ps auxwww | grep -i openvpn
root      6307  0.0  0.1   5112  1808 ?        Ss   09:10   0:00 /usr/sbin/openvpn --daemon server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf
root      6319  0.0  0.2   4276  1904 pts/1    S+   09:10   0:00 grep -i openvpn

Now I have a daemon running!

[root] pi# ls -l /etc/openvpn/*.conf
-rw-r--r-- 1 root root 1621 Dec 25 09:56 /etc/openvpn/server.conf

No other “.conf” file. I then ran the corrected nmap.

[root] pi# nmap -sU 192.168.0.100 -p 1194

Starting Nmap 6.47 ( http://nmap.org ) at 2016-12-26 09:18 PST
Nmap scan report for 192.168.0.100
Host is up.
PORT     STATE         SERVICE
1194/udp open|filtered openvpn
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

I changed client.opvn to remote 71.212.72.245 1194 and voilà!!:

2016-12-26 09:35:26 PROTOCOL OPTIONS:
  cipher: AES-128-CBC
  digest: SHA1
  compress: LZO
  peer ID: -1
2016-12-26 09:35:26 EVENT: ASSIGN_IP
2016-12-26 09:35:26 Google DNS fallback enabled
2016-12-26 09:35:26 Connected via tun
2016-12-26 09:35:26 EVENT: CONNECTED @71.212.72.245:1194 (71.212.72.245) via /UDPv4 on tun/10.8.0.6/
2016-12-26 09:35:26 LZO-ASYM init swap=0 asym=0
2016-12-26 09:35:26 SetStatus Connected

Just to be sure, i then changed client.opvn back to remove <pi.flacco.com> 1194.
I got the same DNS error as before.

Questions:

Why wasn't the daemon running to begin with?
in the nmap results, the state is "open|filtered". the results for ssh and http just say "open". Is "filtered" a problem?
If ssh and http can find pi.flacco.com, why can't openvpn?
how many years of study did it take you to learn how to do this???

SomeGuy

mflac wroteI ran this (on the raspberry server)

[root] pi# ps auxwww | grep -i openvpn
root      6172  0.0  0.2   4276  1940 pts/1    S+   09:07   0:00 grep -i openvpn

No daemon!!! So I ran the command you had showed me earlier:

[root] pi# /usr/sbin/openvpn --daemon server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf

[root] pi# ps auxwww | grep -i openvpn
root      6307  0.0  0.1   5112  1808 ?        Ss   09:10   0:00 /usr/sbin/openvpn --daemon server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf
root      6319  0.0  0.2   4276  1904 pts/1    S+   09:10   0:00 grep -i openvpn

Now I have a daemon running!

It is really good that the damon is running. :-)

The method I gave you for starting it from the command line as root like that was for diagnostics in finding problems. Ideally, you will want to be able to start it with "systemctl" (on this example system) relying on the init scripts so that when your server/device running openvpn server is rebooted, it will start the openvpn server for you. Generally speaking, you won't want to start openvpn server from the command like directly with all of the openvpn flags and args like that. It is not a terrible thing to do; it is a thing to do as a "crutch" to get you to a healthy state with a working init script/service.

Eventually, you should try rebooting your OpenVPN server's OS and then ssh to it and see if the openvpn server is running and your client can connect to it. If not, there may still be an issue with your init script or the registration of your config as something that should be started on boot.

[root] pi# ls -l /etc/openvpn/*.conf
-rw-r--r-- 1 root root 1621 Dec 25 09:56 /etc/openvpn/server.conf

No other “.conf” file. I then ran the corrected nmap.

[root] pi# nmap -sU 192.168.0.100 -p 1194

Starting Nmap 6.47 ( http://nmap.org ) at 2016-12-26 09:18 PST
Nmap scan report for 192.168.0.100
Host is up.
PORT     STATE         SERVICE
1194/udp open|filtered openvpn
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

Unlike other services, the openvpn service will listen on a port, but generally does not immediately send data (or a welcome message) to a connecting client. The OpenVPN server waits for the client to send data to it before it replies, and the data the client sends must match the expectation of the protocol, or risk no response.
This behaviour is indistinguishable by nmap from a service that is really open. (nmap is expecting something in response to the connection/check and without a response assumes filtered.) This is explained in the nmap man page on the status of open, closed open|filtered, and closed|filtered.

I changed client.opvn to remote 71.212.72.245 1194 and voilà!!:

2016-12-26 09:35:26 PROTOCOL OPTIONS:
  cipher: AES-128-CBC
  digest: SHA1
  compress: LZO
  peer ID: -1
2016-12-26 09:35:26 EVENT: ASSIGN_IP
2016-12-26 09:35:26 Google DNS fallback enabled
2016-12-26 09:35:26 Connected via tun
2016-12-26 09:35:26 EVENT: CONNECTED @71.212.72.245:1194 (71.212.72.245) via /UDPv4 on tun/10.8.0.6/
2016-12-26 09:35:26 LZO-ASYM init swap=0 asym=0
2016-12-26 09:35:26 SetStatus Connected

Just to be sure, i then changed client.opvn back to remove <pi.flacco.com> 1194.
I got the same DNS error as before.

That is strange.

Questions:

Why wasn't the daemon running to begin with?

I do not know. Details for that would probably be in the openvpn log on the server.

in the nmap results, the state is "open|filtered". the results for ssh and http just say "open". Is "filtered" a problem?

Explained above. It should not be a problem if your client can connect.

If ssh and http can find pi.flacco.com, why can't openvpn?

I am not sure why your ssh (client application) and http (web application) are able to complete a DNS lookup through the system to IP address and and have that work while your VPN client is not able to complete a DNS lookup. I have guesses, but they are not simple to fix. (Examples: dynamically linked against resolver libraries not installed on the target OS, for example, or some sort of IPv4/IPv6 resolver affinity for AAAA records in DNS over A, DNSSEC validation failure for lookup, other resolvers use a local name caching service while openvpn expects a "resolv.conf" to be populated with DNS Server IP for it to use, etc.) Maybe someone else can help with this on the client you are using. There is probably a simple explanation for this; if I could think of a simple explanation for this, I would suggest it.

(When you edit the configuration file on the client, do not copy/paste the name into that field, manually type it out. If you were copy/pasting it, maybe some artefact in the source is being included but is unprintable in your editor.)

how many years of study did it take you to learn how to do this???

Oh, I just started this last week. ;-) (just joking.)

mflac

As my domain is hosted by google, I did all the steps they suggested to track down resolution problems.
Everything checked out fine.

it's hard to believe that this could be the problem but in my client.opvn I had the line
remote <pi.flacco.com> 1194
I removed the brackets...
remote pi.flacco.com 1194
and it worked! I even have the little vpn indicator on the top of my iPhone screen!

could that really be it?

2016-12-26 20:38:51 VERIFY OK: depth=0
cert. version     : 3
serial number     : 01
issuer name       : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, ??=EasyRSA, emailAddress=me@myhost.mydomain
subject name      : CN=vpn-server
issued  on        : 2016-12-23 16:33:05
expires on        : 2026-12-21 16:33:05
signed using      : RSA with SHA-256
RSA key size      : 2048 bits
basic constraints : CA=false
subject alt name  : vpn-server
cert. type        : SSL Server
key usage         : Digital Signature, Key Encipherment
ext key usage     : TLS Web Server Authentication

2016-12-26 20:38:51 NET WiFi:NotReachable/WR t------
2016-12-26 20:38:51 NET Internet:ReachableViaWWAN/WR t------
2016-12-26 20:38:52 SSL Handshake: (redacted)
2016-12-26 20:38:52 Session is ACTIVE
2016-12-26 20:38:52 EVENT: GET_CONFIG
2016-12-26 20:38:52 Sending PUSH_REQUEST to server...
2016-12-26 20:38:52 OPTIONS:
0 [route] [10.8.0.0] [255.255.255.0] 
1 [redirect-gateway] [def1] 
2 [route] [10.8.0.0] [255.255.255.0] 
3 [topology] [net30] 
4 [ping] [10] 
5 [ping-restart] [120] 
6 [ifconfig] [10.8.0.6] [10.8.0.5] 

2016-12-26 20:38:52 PROTOCOL OPTIONS:
  cipher: AES-128-CBC
  digest: SHA1
  compress: LZO
  peer ID: -1
2016-12-26 20:38:52 EVENT: ASSIGN_IP
2016-12-26 20:38:52 Google DNS fallback enabled
2016-12-26 20:38:52 Connected via tun
2016-12-26 20:38:52 EVENT: CONNECTED @pi.flacco.com:1194 (71.212.72.245) via /UDPv4 on tun/10.8.0.6/
2016-12-26 20:38:52 LZO-ASYM init swap=0 asym=0
2016-12-26 20:38:52 SetStatus Connected

SomeGuy

mflac wroteit's hard to believe that this could be the problem but in my client.opvn I had the line
remote <pi.flacco.com> 1194
I removed the brackets...
remote pi.flacco.com 1194
and it worked! I even have the little vpn indicator on the top of my iPhone screen!

could that really be it?

Yep!

DNS names for hosts (A, AAAA, CNAME) are only allowed to have [a-zA-Z0-9] and "-" so long as "." are not adjacent , and "-" are between one or more [a-zA-Z0-9] and "." do not start the FQDN.

"<" and ">" are not allowed in A, AAAA, or CNAME records.

Sorry, I assumed your "<" and ">" chars were meant to identify and highlight the replacement, not literal characters.

...
2016-12-26 20:38:52 SetStatus Connected

Congrats! Now you have working config, you should be free to experiment, and read your config, and test other options/features.

Don't forget to copy your current client and server config as "working" in case you need to fall-back to them after testing does not work as expected.

Don't forget to reboot the server that has your "OpenVPN" service to see if it auto-starts on boot.

mflac

Interesting that the "< >" were inserted by the script MakeOPVN that I had linked to above. I just goes to show the danger of using a tool that you don't really understand!

Since making these changes, the raspberry server boots up every time with the openvpn daemon running and all my devices can connect instantly. It even seems to be a more robust connection than some of the commercial VPNs that I have used. My next goal is to go back and study all the commands in the various configuration files, many of which I have only the vaguest understanding. If I get brave, I might even try to add obfsproxy to my setup. I'm sure I'll be back with more questions!

Thank you again for all your help. Happy New Year!