Multiple tun/tap interfaces being created

blockchainy

Hi Everyone,

First post, newbie, but learning. I tried to read up on this but can't find a solution. My vpn provider has many openvpn server addresses available around the world. I like changing servers each time I get online, so I setup about 6 of them in the VPN section of the ubuntu network configuration tab. I also run a firewall kill switch. The problem is that each time I connect and disconnect from an opevpn server, I seem to get a new tun/tap device created. So when I run "ip link show" I see tun0, tun1, tun2, tun3, etc, etc. At some point I create so many tun/tap's that my firewall kill switch has a problem, which I've solved by editing it to handle up to tun11. But after that I have to reboot to get back to tun0. Is there some way to force openvpn to always use tun0 even if I connect to one openvpn server, then disconnect, then connect to different one, all using the ubuntu GUI?

I'm probably not using the most elegant setup, but I prefer to use the ubuntu GUI because it's just three clicks to start openvpn and pick a server from the list of one's I've configured. I have no problem coding things like my ufw firewall script and using a prompt to get things setup, configured, updated, etc. But if you have a permanent fix that lets me continue to use the default GUI (gnome?) to connect/disconnect from the various openvpn servers I have configured, please help suggest one. I'm not a linux guru but I'm a fast learner. I looked everywhere for how to force it all to tun0, but can't find any information even suggesting I should be getting tun1, tun2, tun3, etc...

Thanks in advance.

Cheers.

B

TinCanTech

Use --dev tunX where X is a number as per the manual.

blockchainy

Hi Tin,

Thank you for replying. I'm still very new to a lot of this so I don't fully understand your helpful reply. When creating new entries in the openvpn dialogue via gnome, it asks for the .ovpn file provided by my vpn provider. That file does have a line with "dev tun" in it, but now that the entries have all already been created, the .ovpn file is no longer referenced. When I launch a connection I just go into the gnome vpn list (top right menu near the power icon) and click on one. In their settings, I do see a tab to name the tunnel, and it just says "tun", but if I set that to "tun0" it fails to connect. I'm half wondering if you mean I should have --dev tun0 in some other openvpn client config file that will make it permanently do this for all of the server entries I've created in the networking/vpn section of gnome. Please help. Sorry I don't know more about this.

B

Here's what my .ovpn files have, w/server and port changed for this online post:

client
remote server.address.here Porthere
dev tun
proto udp
auth-user-pass

resolv-retry infinite
redirect-gateway def1
persist-key
persist-tun
nobind
cipher AES-256-CBC
auth SHA256
ping 5
ping-exit 60
ping-timer-rem
explicit-exit-notify 2
script-security 2
remote-cert-tls server
route-delay 5
tun-mtu 1500
fragment 1300
mssfix 1300
verb 4
comp-lzo

ca /home/ubu18/c/ca.crt

cert /home/ubu18/c/client.crt

key /home/ubu18/c/client.key

TinCanTech

Use a different --dev tunX in each of your configs and then the device is hard coded and predictable.

I do not have instructions to integrate that into your OS GUI (Presumably Network-Manager).
We recommend that you use openvpn as a service, usually using systemd, and only use Network-Manager once you have your configs working the way you want.

blockchainy

Hi Tin,

Thank you again for taking the time to respond. I tried what you suggested and it while I can now specify the tunnel number for each of my connections (that was either editable in the config line "dev tunX" or just by adjusting it in the network manager advanced settings for a given vpn setup. But, that doesn't solve the problem because once I've connected, used for a moment, then disconnected from a given vpn server, the tun device persists in the list. And when I try to go back and connect to that server again in the future, I now get a "connection failed" message, presumably because the tunX already exists. And of course if I just leave them all as "tun" without a number, I'm back to having an slowly growing pile of tun devices that eventually hits 11, which is the limit of how many entries my already bloated ufw firewall can handle.

So to summarize, they can't all be specified as "tun0", nor can each of them bet set uniquely to tun0 - tun6, because once a connection gets into the list, it doesn't go away after I disconnect, and future attempts to connect that server will generate a "connection failed" message. What a mess. Any ideas? Here's an example of what ip link displays after I've connected then disconnected a few times to a few servers:

:~$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
link/ether 08:00:27:3f:82:d1 brd ff:ff:ff:ff:ff:ff
6: tun3: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 100
link/none
7: tun4: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 100
link/none

I wish it would just delete the tun device automatically each time I disconnect. If it did that, they would all be tun0 by default, which seems to be the way it should be. Why do they persist after disconnect? That's a problematic "feature" if it is one.

Thank you again for helping.

B

TinCanTech

blockchainy wrote or just by adjusting it in the network manager advanced settings for a given vpn setup. But, that doesn't solve the problem because once I've connected, used for a moment, then disconnected from a given vpn server, the tun device persists in the list

Then that is probably a bug in network-manager, do not use network-manager.

blockchainy

Interesting. I would love to test this to see if that's indeed the problem. I tried everything I could to figure out how to get my configs to connect from a bash prompt, but no luck. Here's what I was doing. Is this right?

sudo openvpn --config /path/to/config.ovpn

It then successfully loaded my config (the text of which is in an earlier comment above), asked for my user/pass, which I entered, displayed a host of parameters and other messages (which would reveal my host so I'm not pasting), and all seemed to be well, but after it finally landed on:

Sun Dec 15 13:41:37 2019 us=873831 Initialization Sequence Completed

I then tried to connect via a browser but nothing. I also didn't see the network icon in the top right indicate a vpn connection was active.

Any ideas? Or if you're savvy enough, could you try to connect/disconnect a few times from a few different servers, all with "dev tun" in their configs, and see if the tun devices persist? I really appreciate your help and advise on this. I've already learned a lot.

Cheers.

B.