Service startup issue and client connection

Net_Spy

Dear Community,

I just installed openvpn on my centos 8 . I configured it on tcp port 443 .

#File-Configuration
port 443
proto tcp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh.pem
server 10.10.10.0 255.255.255.0
mode server
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 208.67.222.222"
#client-config-dir /etc/openvpn/ccd # for fixed ip assigning for client
#ifconfig-pool-persist /etc/openvpn/ipp.txt #log previous ip of cliemt
tls-auth /etc/openvpn/server/ta.key 0 # This file is secret
auth SHA256
key-direction 0
cipher AES-256-CBC
explicit-exit-notify 0
#cipher AES-256-GCM
client-to-client
#duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 4
mute 20

Error when runing following cmd

sudo systemctl start openvpn-server@server.service

Job for openvpn-server@server.service failed because the control process exited with error code.
See "systemctl status openvpn-server@server.service" and "journalctl -xe" for details.

-- Unit openvpn-server@server.service has begun starting up.
May 26 18:59:01 ns395235.ip-37-59-38.eu openvpn[31358]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
May 26 18:59:01 ns395235.ip-37-59-38.eu openvpn[31358]: Use --help for more information.
May 26 18:59:01 ns395235.ip-37-59-38.eu systemd[1]: openvpn-server@server.service: Main process exited, code=exited, status=1/FAILURE
May 26 18:59:01 ns395235.ip-37-59-38.eu systemd[1]: openvpn-server@server.service: Failed with result 'exit-code'.
May 26 18:59:01 ns395235.ip-37-59-38.eu systemd[1]: Failed to start OpenVPN service for server.
-- Subject: Unit openvpn-server@server.service has failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit openvpn-server@server.service has failed.

[b]sudo systemctl start openvpn-server@server.service[/b]

● openvpn-server@server.service - OpenVPN service for server
   Loaded: loaded (/usr/lib/systemd/system/openvpn-server@.service; enabled; vendor preset: disabled)
   Active: activating (auto-restart) (Result: exit-code) since Tue 2020-05-26 18:56:38 UTC; 1s ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
  Process: 31218 ExecStart=/usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128->
 Main PID: 31218 (code=exited, status=1/FAILURE)

Systemctl startup script:

[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure

[Install]
WantedBy=multi-user.target

But Iam able to run it via

sudo openvpn --config /etc/openvpn/server.conf

But client unable to connect

Tue May 26 23:59:24 2020 TCP: connect to [AF_INET]x.x.x.x:443 failed: Unknown error
Tue May 26 23:59:24 2020 SIGUSR1[connection failed(soft),init_instance] received, process restarting
Tue May 26 23:59:24 2020 MANAGEMENT: >STATE:1590519564,RECONNECTING,init_instance,,,,,
Tue May 26 23:59:24 2020 Restart pause, 10 second(s)
Tue May 26 23:59:34 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Tue May 26 23:59:34 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue May 26 23:59:34 2020 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Tue May 26 23:59:34 2020 MANAGEMENT: >STATE:1590519574,TCP_CONNECT,,,,,,
Wed May 27 00:01:35 2020 TCP: connect to [AF_INET]x.x.x.x:443 failed: Unknown error
Wed May 27 00:01:35 2020 SIGUSR1[connection failed(soft),init_instance] received, process restarting
Wed May 27 00:01:35 2020 MANAGEMENT: >STATE:1590519695,RECONNECTING,init_instance,,,,,
Wed May 27 00:01:35 2020 Restart pause, 20 second(s)
Wed May 27 00:01:55 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Wed May 27 00:01:55 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed May 27 00:01:55 2020 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Wed May 27 00:01:55 2020 MANAGEMENT: >STATE:1590519715,TCP_CONNECT,,,,,,
Wed May 27 00:03:56 2020 TCP: connect to [AF_INET]x.x.x.x:443 failed: Unknown error
Wed May 27 00:03:56 2020 SIGUSR1[connection failed(soft),init_instance] received, process restarting
Wed May 27 00:03:56 2020 MANAGEMENT: >STATE:1590519836,RECONNECTING,init_instance,,,,,
Wed May 27 00:03:56 2020 Restart pause, 40 second(s)
Wed May 27 00:04:36 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:443
Wed May 27 00:04:36 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed May 27 00:04:36 2020 Attempting to establish TCP connection with [AF_INET]x.x.x.x:443 [nonblock]
Wed May 27 00:04:36 2020 MANAGEMENT: >STATE:1590519876,TCP_CONNECT,,,,,,

client
dev tun
proto tcp
remote x.x.x.x 443 #This is serve IP
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-256-CBC
auth SHA256
remote-cert-tls server
key-direction 1
comp-lzo
auth-nocache
verb 3
<ca>
-----BEGIN CERTIFICATE-----
MIIDSzCCAjOgAwIBAgIUbNNHVdGNJfSRofenXBBKIlKpOQYwDQYJKoZIhvcNAQEL
BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjAwNTI2MTIyMjU2WhcNMzAw.....
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
11:76:b0:ab:73:5d:b3:13:de:43:82:40:46:a9:65:a7
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=Easy-RSA CA
Validity
Not Before: May 26 13:42:55 2020 GMT
Not After : Aug 29 13:42:55 2022 GMT
Subject: CN=linksys
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:b9:23:97:96:f0:4e:35:16:72:cb:94:f0:d1:09:
7e:ba:fc:86:22:83:7e:d9:d2:38:0c:6e:67:dc:93:
8e:0f:f2:9b:42:e0:62:2c:07:15:18:b5:67:df:e9:.......

-----BEGIN CERTIFICATE-----
MIIDVTCCAj2gAwIBAgIQEXawq3NdsxPeQ4JARqllpzANBgkqhkiG9w0BAQsFADAW
MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTAeFw0yMDA1MjYxMzQyNTVaFw0yMjA4Mjkx....
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC5I5eW8E41FnLL
lPDRCX66/IYig37Z0jgMbmfck44P8ptC4GIsBxUYtWff6S9vPktoFK5dZMU3Ikku....
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
cb2ef89c145ec17db3e04fec6dc026b3
267b34b3d958ba09376c94ab980d8d09......
-----END OpenVPN Static key V1-----
</tls-auth>

TinCanTech

Net_Spy wrote WorkingDirectory=/etc/openvpn/server

marklg

I see you already have

WorkingDirectory=/etc/openvpn/server

in your startup script.

What version of OpenVPN? For me, OpenVPN 2.4.9 does not start. OpenVPN 2.4.8 starts correctly with the same configuration.

See my post at https://forums.openvpn.net/viewtopic.php?f=4&t=30291.

Regards,

Mark

TinCanTech

@marklg https://forums.openvpn.net/viewtopic.php?f=30&t=22603

It is rude to hijack threads..

marklg

I did not see it as hijacking a thread. I saw it as it could possibly be the same issue and pointing to another thread that may help the original poster. I saw that as preferred to wastefully repeating the same information in this thread.

Regards,

Mark

TinCanTech

marklg wrote I saw it as it could possibly be the same issue

Unless you post the requested information we will never know ..