WARNING: Failed running command (--up/--down)

mgbolts

Hi,

My apologies for posting this 'fairly common' error. I have been through a bunch of other similar posts but still cant nut the error out.

I am trying to get an ubuntu 18 server configured with openvpn client to vpn service provided whilst still retaining local access to my server (eg 22, 80 etc). The main issue is WARNING: Failed running command (--up/--down): could not execute external program

Mon Sep 3 21:07:18 2018 WARNING: --keysize is DEPRECATED and will be removed in OpenVPN 2.6
Mon Sep 3 21:07:18 2018 WARNING: file 'pass.txt' is group or others accessible
Mon Sep 3 21:07:18 2018 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2018
Mon Sep 3 21:07:18 2018 library versions: OpenSSL 1.1.0g 2 Nov 2017, LZO 2.08
Mon Sep 3 21:07:18 2018 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Mon Sep 3 21:07:18 2018 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Sep 3 21:07:18 2018 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Sep 3 21:07:18 2018 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Sep 3 21:07:18 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]185.230.125.140:1195
Mon Sep 3 21:07:18 2018 Socket Buffers: R=[212992->425984] S=[212992->425984]
Mon Sep 3 21:07:18 2018 UDP link local: (not bound)
Mon Sep 3 21:07:18 2018 UDP link remote: [AF_INET]185.230.125.140:1195
Mon Sep 3 21:07:18 2018 TLS: Initial packet from [AF_INET]185.230.125.140:1195, sid=10bd1fca 69c3e9f5
Mon Sep 3 21:07:18 2018 VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
Mon Sep 3 21:07:18 2018 VERIFY OK: nsCertType=SERVER
Mon Sep 3 21:07:18 2018 VERIFY X509NAME OK: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-3152-0a, emailAddress=support@expressvpn.com
Mon Sep 3 21:07:18 2018 VERIFY OK: depth=0, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-3152-0a, emailAddress=support@expressvpn.com
Mon Sep 3 21:07:19 2018 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Mon Sep 3 21:07:19 2018 [Server-3152-0a] Peer Connection Initiated with [AF_INET]185.230.125.140:1195
Mon Sep 3 21:07:20 2018 SENT CONTROL [Server-3152-0a]: 'PUSH_REQUEST' (status=1)
Mon Sep 3 21:07:21 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.175.0.1,route 10.175.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.175.0.106 10.175.0.105'
Mon Sep 3 21:07:21 2018 OPTIONS IMPORT: timers and/or timeouts modified
Mon Sep 3 21:07:21 2018 OPTIONS IMPORT: --ifconfig/up options modified
Mon Sep 3 21:07:21 2018 OPTIONS IMPORT: route options modified
Mon Sep 3 21:07:21 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Sep 3 21:07:21 2018 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Sep 3 21:07:21 2018 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Sep 3 21:07:21 2018 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Sep 3 21:07:21 2018 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Sep 3 21:07:21 2018 ROUTE_GATEWAY 10.20.0.1/255.255.255.0 IFACE=ens192 HWADDR=00:0c:29:83:84:21
Mon Sep 3 21:07:21 2018 TUN/TAP device tun0 opened
Mon Sep 3 21:07:21 2018 TUN/TAP TX queue length set to 100
Mon Sep 3 21:07:21 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Sep 3 21:07:21 2018 /sbin/ip link set dev tun0 up mtu 1500
Mon Sep 3 21:07:21 2018 /sbin/ip addr add dev tun0 local 10.175.0.106 peer 10.175.0.105
Mon Sep 3 21:07:21 2018 /etc/openvpn/iptables.sh tun0 1500 1606 10.175.0.106 10.175.0.105 init
Mon Sep 3 21:07:21 2018 WARNING: Failed running command (--up/--down): could not execute external program
Mon Sep 3 21:07:21 2018 Exiting due to fatal error

TinCanTech

config file please

mgbolts

Yes, sorry, planned to do as second post but being new....needed mod approval of post 🙂 here it is now.

client
dev tun
fast-io
persist-key
persist-tun
nobind
remote switzerland-2-ca-version-2.expressnetw.com 1195

remote-random
pull
comp-lzo no
tls-client
verify-x509-name Server name-prefix
ns-cert-type server
key-direction 1
route-method exe
route-delay 2
tun-mtu 1500
fragment 1300
mssfix 1450
verb 3
cipher AES-256-CBC
keysize 256
auth SHA512
sndbuf 524288
rcvbuf 524288
auth-user-pass pass.txt
route-noexec
auth-nocache
script-security 2

#up and down scripts to be executed when VPN starts or stops
up /etc/openvpn/iptables.sh
down /etc/openvpn/update-resolv-conf

<cert>
-----BEGIN CERTIFICATE-----

mgbolts

Here also the file permissions etc:

drwxr-xr-x 2 root root 4096 Feb 11 2018 client
-rwxrwxrwx 1 vpn vpn 1597 Sep 3 16:47 iptables.sh
-rwxr-xr-x 1 vpn vpn 6284 Sep 3 20:26 openvpn.conf
-rw-r--r-- 1 root root 50 Sep 3 16:37 pass.txt
-rwxrwxrwx 1 root root 611 Sep 3 15:11 routing.sh
drwxr-xr-x 2 root root 4096 Feb 11 2018 server
-rwxrwxrwx 1 vpn vpn 1301 Feb 11 2018 update-resolv-conf

TinCanTech

All commands in the script require full path.

mgbolts

TinCanTech wrote All commands in the script require full path.

Excuse my ignorance on the nomenclature, the up and down are full path, right? The others are settings. What am I missing?

TinCanTech

Post your script and I will explain.

mgbolts

Herewith the iptables.sh script. My local IP, still provisioned by DHCP but with static 10.20.0.95. My reg interface is ens192 (not the more common eth0). The user is: vpn which will be forced down the vpn tunnel tun0 interface with other users using the regular ens192 interface.

#! /bin/bash
# Niftiest Software – www.niftiestsoftware.com
# Modified version by HTPC Guides – www.htpcguides.com

export INTERFACE="tun0"
export VPNUSER="vpn"
export LOCALIP="10.20.0.95"
export NETIF="ens192"

# flushes all the iptables rules, if you have other rules to use then add them into the script
iptables -F -t nat
iptables -F -t mangle
iptables -F -t filter

# mark packets from $VPNUSER
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT ! --dest $LOCALIP -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p udp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p tcp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT ! --src $LOCALIP -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

# allow responses
iptables -A INPUT -i $INTERFACE -m conntrack --ctstate ESTABLISHED -j ACCEPT

# block everything incoming on $INTERFACE to prevent accidental exposing of ports
iptables -A INPUT -i $INTERFACE -j REJECT

# let $VPNUSER access lo and $INTERFACE
iptables -A OUTPUT -o lo -m owner --uid-owner $VPNUSER -j ACCEPT
iptables -A OUTPUT -o $INTERFACE -m owner --uid-owner $VPNUSER -j ACCEPT

# all packets on $INTERFACE needs to be masqueraded
iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE

# reject connections from predator IP going over $NETIF
iptables -A OUTPUT ! --src $LOCALIP -o $NETIF -j REJECT

# Start routing script
/etc/openvpn/routing.sh

exit 0

mgbolts

Herewith the update-resolv-conf file. That should be both the up and down script. Let me know if you require any more.

#!/bin/bash
#
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood and Chris Hanson.
# Licensed under the GNU GPL. See /usr/share/common-licenses/GPL.
#
# Example envs set from openvpn:
#
# foreign_option_1='dhcp-option DNS 193.43.27.132'
# foreign_option_2='dhcp-option DNS 193.43.27.133'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
#

[ -x /sbin/resolvconf ] || exit 0
[ "$script_type" ] || exit 0
[ "$dev" ] || exit 0

split_into_parts()
{
part1="$1"
part2="$2"
part3="$3"
}

case "$script_type" in
up)
NMSRVRS=""
SRCHS=""
for optionvarname in ${!foreign_option_*} ; do
option="${!optionvarname}"
echo "$option"
split_into_parts $option
if [ "$part1" = "dhcp-option" ] ; then
if [ "$part2" = "DNS" ] ; then
NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3"
elif [ "$part2" = "DOMAIN" ] ; then
SRCHS="${SRCHS:+$SRCHS }$part3"
fi
fi
done
R=""
[ "$SRCHS" ] && R="search $SRCHS
"
for NS in $NMSRVRS ; do
R="${R}nameserver $NS
"
done
echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"
;;
down)
/sbin/resolvconf -d "${dev}.openvpn"
;;
esac

TinCanTech

Both scripts are missing the shebang:

#!/bin/bash

is presumably what you are actually using.

mgbolts wrote

iptables -F -t nat

This must be:

/sbin/iptables -F -t nat

that is "full path to executable" and all other lines and commands must be full path.

mgbolts

Thanks TCT. Good points...I did check this. For some reason it managed to get deleted when I converted the posts to the BB tag...see top few lines of both script files below. I will need to check your last point and revert shortly. Thanks once again!

cat iptables.sh

#! /bin/bash
# Niftiest Software – www.niftiestsoftware.com
# Modified version by HTPC Guides – www.htpcguides.com
...
...

cat update-resolv-conf

#!/bin/bash
#
# Parses DHCP options from openvpn to update resolv.conf
...
...

mgbolts

@TCT - No luck with adding /sbin/ to iptables.. to all the lines.

I did however stumble on this post which noted that 18.04 does not 'ship' with the /sbin/resolvconf file. Both are referenced in the update-resolv-conf file and no, the file does not exist. Do you think this a red herring?

https://askubuntu.com/questions/1032476/ubuntu-18-04-no-dns-resolution-when-connected-to-openvpn

TinCanTech

It is not a Red Herring .. you need that script.
https://forums.openvpn.net/viewtopic.php?t=20543

I presume you know how to write scripts because I do not debug them ..
I'm only here to tell you what openvpn requires.

If you need help with your script then you can contact me privately : tincanteksup <at> gmail

mgbolts

Thanks for the confirmation. Will get cracking or coding 🙂

biofool

This is a packaging issue. On LInux openvpn relies on /sbin/resolvconf to implement the directives in update-resolv-conf.
However that command is not installed when you install openvpn so you need to install it manually.

sudo apt install resolvconf

Fixed this issue for me on Ubuntu bionc/18.