Openvpn Debian 10

hipez

Hello

I have installed OpenVPN on Debian Buster. My configuration is classical.
It works well, but I have dns leaks

On the client without OpenVPN : cat /etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 192.168.122.1
nameserver 127.0.0.53

On the client with OpenVPN : cat /etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 208.67.222.222
nameserver 208.67.220.220
nameserver 192.168.122.1

On the client with OpenVPN : host www.google.com 208.67.222.222

Using domain server:
Name: 208.67.222.222
Address: 208.67.222.222#53
Aliases: 

www.google.com has address 216.58.213.132
www.google.com has IPv6 address 2a00:1450:4007:810::2004

The server pushes well 208.67.222.222 and 208.67.220.220 on the client. But the "Current DNS Server" is unchanged (Current DNS Server: 192.168.122.1).

How can I do what the DNS requests don't use 192.168.122.1 with the VPN ?

Thanks

TinCanTech

OpenVPN does not configure DNS for Linux, you need something like this:
https://github.com/jonathanio/update-systemd-resolved

hipez

Hello,

Thank you very much for your answer !
It's seem works when OpenVPN is running. The DNS configuration is good.

But, when Openvpn is not running, the DNS configuration doesn't work.

systemctl stop openvpn@client
curl ifconfig.me
curl: (6) Could not resolve host: ifconfig.me

Here's what I did :

apt install openvpn-systemd-resolved
systemctl enable systemd-resolved.service
systemctl start systemd-resolved.service

nano /etc/nsswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         files systemd
group:          files systemd
shadow:         files
gshadow:        files

hosts:          files resolve [!UNAVAIL=return] dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

# Use /etc/resolv.conf first, then fall back to systemd-resolved
hosts: files dns resolve myhostname
# Use systemd-resolved first, then fall back to /etc/resolv.conf
hosts: files resolve dns myhostname
# Don't use /etc/resolv.conf at all
hosts: files resolve myhostname

ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

nano /etc/openvpn/client.conf

client
dev tun
proto udp
remote [my-server-2] 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca client/ca.crt
cert client/client.crt
key client/client.key
remote-cert-tls server
tls-auth client/ta.key 1
cipher AES-256-CBC
verb 4
dhcp-option DOMAIN-ROUTE .
script-security 2
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
up /etc/openvpn/update-systemd-resolved
up-restart
down /etc/openvpn/update-systemd-resolved
down-pre

What is wrong ?

TinCanTech

hipez wroteWhat is wrong ?

Need to see full client log at --verb 4 -- Remove any private information.

hipez

My client log :

Oct 21 18:55:09 Paper systemd[1]: Starting Network Manager Wait Online...
Oct 21 18:55:09 Paper systemd[1]: Created slice system-openvpn.slice.
Oct 21 18:55:09 Paper systemd[1]: Started Network Manager Wait Online.
Oct 21 18:55:09 Paper systemd[1]: Reached target Network is Online.
Oct 21 18:55:09 Paper systemd[1]: Starting OpenVPN connection to client...
Oct 21 18:55:09 Paper ovpn-client[1150]: Current Parameter Settings:
Oct 21 18:55:09 Paper ovpn-client[1150]:   config = '/etc/openvpn/client.conf'
Oct 21 18:55:09 Paper ovpn-client[1150]:   mode = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   persist_config = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   persist_mode = 1
Oct 21 18:55:09 Paper ovpn-client[1150]:   show_ciphers = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   show_digests = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   show_engines = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   genkey = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   key_pass_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   show_tls_ciphers = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   connect_retry_max = 0
Oct 21 18:55:09 Paper ovpn-client[1150]: Connection profiles [0]:
Oct 21 18:55:09 Paper ovpn-client[1150]:   proto = udp
Oct 21 18:55:09 Paper ovpn-client[1150]:   local = '[UNDEF]'
Oct 21 18:55:09 Paper systemd[1]: Started OpenVPN connection to client.
Oct 21 18:55:09 Paper ovpn-client[1150]:   local_port = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote = '10.10.10.10'
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_port = '1119'
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_float = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   bind_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   bind_local = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   bind_ipv6_only = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   connect_retry_seconds = 5
Oct 21 18:55:09 Paper ovpn-client[1150]:   connect_timeout = 120
Oct 21 18:55:09 Paper ovpn-client[1150]:   socks_proxy_server = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   socks_proxy_port = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   tun_mtu = 1500
Oct 21 18:55:09 Paper ovpn-client[1150]:   tun_mtu_defined = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   link_mtu = 1500
Oct 21 18:55:09 Paper ovpn-client[1150]:   link_mtu_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   tun_mtu_extra = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   tun_mtu_extra_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   mtu_discover_type = -1
Oct 21 18:55:09 Paper ovpn-client[1150]:   fragment = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   mssfix = 1450
Oct 21 18:55:09 Paper ovpn-client[1150]:   explicit_exit_notification = 0
Oct 21 18:55:09 Paper ovpn-client[1150]: Connection profiles END
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_random = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   ipchange = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   dev = 'tun'
Oct 21 18:55:09 Paper ovpn-client[1150]:   dev_type = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   dev_node = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   lladdr = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   topology = 1
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_local = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_remote_netmask = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_noexec = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_nowarn = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_ipv6_local = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_ipv6_netbits = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_ipv6_remote = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   shaper = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   mtu_test = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   mlock = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   keepalive_ping = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   keepalive_timeout = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   inactivity_timeout = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ping_send_timeout = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ping_rec_timeout = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ping_rec_timeout_action = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ping_timer_remote = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   remap_sigusr1 = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   persist_tun = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   persist_local_ip = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   persist_remote_ip = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   persist_key = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   passtos = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   resolve_retry_seconds = 1000000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   resolve_in_advance = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   username = 'nobody'
Oct 21 18:55:09 Paper ovpn-client[1150]:   groupname = 'nogroup'
Oct 21 18:55:09 Paper ovpn-client[1150]:   chroot_dir = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   cd_dir = '/etc/openvpn'
Oct 21 18:55:09 Paper ovpn-client[1150]:   writepid = '/run/openvpn/client.pid'
Oct 21 18:55:09 Paper ovpn-client[1150]:   up_script = '/etc/openvpn/update-systemd-resolved'
Oct 21 18:55:09 Paper ovpn-client[1150]:   down_script = '/etc/openvpn/update-systemd-resolved'
Oct 21 18:55:09 Paper ovpn-client[1150]:   down_pre = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   up_restart = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   up_delay = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   daemon = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   inetd = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   log = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   suppress_timestamps = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   machine_readable_output = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   nice = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   verbosity = 4
Oct 21 18:55:09 Paper ovpn-client[1150]:   mute = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   gremlin = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   status_file = '/run/openvpn/client.status'
Oct 21 18:55:09 Paper ovpn-client[1150]:   status_file_version = 1
Oct 21 18:55:09 Paper ovpn-client[1150]:   status_file_update_freq = 10
Oct 21 18:55:09 Paper ovpn-client[1150]:   occ = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   rcvbuf = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   sndbuf = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   mark = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   sockflags = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   fast_io = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   comp.alg = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   comp.flags = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_script = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_default_gateway = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_default_metric = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_noexec = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_delay = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_delay_window = 30
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_delay_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_nopull = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   route_gateway_via_dhcp = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   allow_pull_fqdn = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_addr = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_port = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_user_pass = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_log_history_cache = 250
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_echo_buffer_size = 100
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_write_peer_info_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_client_user = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_client_group = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   management_flags = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   shared_secret_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   key_direction = 1
Oct 21 18:55:09 Paper ovpn-client[1150]:   ciphername = 'AES-256-CBC'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ncp_enabled = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Oct 21 18:55:09 Paper ovpn-client[1150]:   authname = 'SHA1'
Oct 21 18:55:09 Paper ovpn-client[1150]:   prng_hash = 'SHA1'
Oct 21 18:55:09 Paper ovpn-client[1150]:   prng_nonce_secret_len = 16
Oct 21 18:55:09 Paper ovpn-client[1150]:   keysize = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   engine = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   replay = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   mute_replay_warnings = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   replay_window = 64
Oct 21 18:55:09 Paper ovpn-client[1150]:   replay_time = 15
Oct 21 18:55:09 Paper ovpn-client[1150]:   packet_id_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   use_iv = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   test_crypto = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_server = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_client = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   key_method = 2
Oct 21 18:55:09 Paper ovpn-client[1150]:   ca_file = 'client/ca.crt'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ca_path = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   dh_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   cert_file = 'client/client01.crt'
Oct 21 18:55:09 Paper ovpn-client[1150]:   extra_certs_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   priv_key_file = 'client/client01.key'
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs12_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   cipher_list = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   cipher_list_tls13 = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_cert_profile = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_verify = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_export_cert = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   verify_x509_type = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   verify_x509_name = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   crl_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ns_cert_type = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 65535
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_ku[i] = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   remote_cert_eku = 'TLS Web Server Authentication'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ssl_flags = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_timeout = 2
Oct 21 18:55:09 Paper ovpn-client[1150]:   renegotiate_bytes = -1
Oct 21 18:55:09 Paper ovpn-client[1150]:   renegotiate_packets = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   renegotiate_seconds = 3600
Oct 21 18:55:09 Paper ovpn-client[1150]:   handshake_window = 60
Oct 21 18:55:09 Paper ovpn-client[1150]:   transition_window = 3600
Oct 21 18:55:09 Paper ovpn-client[1150]:   single_session = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   push_peer_info = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_exit = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_auth_file = 'client/ta.key'
Oct 21 18:55:09 Paper ovpn-client[1150]:   tls_crypt_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_protected_authentication = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_private_mode = 00000000
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_cert_private = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_pin_cache_period = -1
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_id = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   pkcs11_id_management = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_network = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_netmask = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_network_ipv6 = ::
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_netbits_ipv6 = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_bridge_ip = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_bridge_netmask = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_bridge_pool_start = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   server_bridge_pool_end = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_pool_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_pool_start = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_pool_end = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_pool_netmask = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_pool_persist_filename = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_pool_persist_refresh_freq = 600
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_ipv6_pool_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_ipv6_pool_base = ::
Oct 21 18:55:09 Paper ovpn-client[1150]:   ifconfig_ipv6_pool_netbits = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   n_bcast_buf = 256
Oct 21 18:55:09 Paper ovpn-client[1150]:   tcp_queue_limit = 64
Oct 21 18:55:09 Paper ovpn-client[1150]:   real_hash_size = 256
Oct 21 18:55:09 Paper ovpn-client[1150]:   virtual_hash_size = 256
Oct 21 18:55:09 Paper ovpn-client[1150]:   client_connect_script = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   learn_address_script = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   client_disconnect_script = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   client_config_dir = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   ccd_exclusive = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   tmp_dir = '/tmp'
Oct 21 18:55:09 Paper ovpn-client[1150]:   push_ifconfig_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   push_ifconfig_local = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   push_ifconfig_remote_netmask = 0.0.0.0
Oct 21 18:55:09 Paper ovpn-client[1150]:   push_ifconfig_ipv6_defined = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   push_ifconfig_ipv6_local = ::/0
Oct 21 18:55:09 Paper ovpn-client[1150]:   push_ifconfig_ipv6_remote = ::
Oct 21 18:55:09 Paper ovpn-client[1150]:   enable_c2c = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   duplicate_cn = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   cf_max = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   cf_per = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   max_clients = 1024
Oct 21 18:55:09 Paper ovpn-client[1150]:   max_routes_per_client = 256
Oct 21 18:55:09 Paper ovpn-client[1150]:   auth_user_pass_verify_script = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   auth_user_pass_verify_script_via_file = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   auth_token_generate = DISABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   auth_token_lifetime = 0
Oct 21 18:55:09 Paper ovpn-client[1150]:   port_share_host = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   port_share_port = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]:   client = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   pull = ENABLED
Oct 21 18:55:09 Paper ovpn-client[1150]:   auth_user_pass_file = '[UNDEF]'
Oct 21 18:55:09 Paper ovpn-client[1150]: OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Oct 21 18:55:09 Paper ovpn-client[1150]: library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Oct 21 18:55:09 Paper ovpn-client[1150]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct 21 18:55:09 Paper ovpn-client[1150]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 21 18:55:09 Paper ovpn-client[1150]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 21 18:55:09 Paper ovpn-client[1150]: Control Channel MTU parms [ L:1621 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Oct 21 18:55:09 Paper ovpn-client[1150]: Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Oct 21 18:55:09 Paper ovpn-client[1150]: Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Oct 21 18:55:09 Paper ovpn-client[1150]: Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Oct 21 18:55:09 Paper ovpn-client[1150]: TCP/UDP: Preserving recently used remote address: [AF_INET]10.10.10.10:1119
Oct 21 18:55:09 Paper ovpn-client[1150]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Oct 21 18:55:09 Paper ovpn-client[1150]: UDP link local: (not bound)
Oct 21 18:55:09 Paper ovpn-client[1150]: UDP link remote: [AF_INET]10.10.10.10:1119
Oct 21 18:55:09 Paper ovpn-client[1150]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Oct 21 18:55:09 Paper ovpn-client[1150]: TLS: Initial packet from [AF_INET]10.10.10.10:1119, sid=a98d1fe4 f9bbdd09
Oct 21 18:55:09 Paper ovpn-client[1150]: VERIFY OK: depth=1, CN=steel_server
Oct 21 18:55:09 Paper ovpn-client[1150]: VERIFY KU OK
Oct 21 18:55:09 Paper ovpn-client[1150]: Validating certificate extended key usage
Oct 21 18:55:09 Paper ovpn-client[1150]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Oct 21 18:55:09 Paper ovpn-client[1150]: VERIFY EKU OK
Oct 21 18:55:09 Paper ovpn-client[1150]: VERIFY OK: depth=0, CN=server
Oct 21 18:55:09 Paper ovpn-client[1150]: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Oct 21 18:55:09 Paper ovpn-client[1150]: [server] Peer Connection Initiated with [AF_INET]10.10.10.10:1119
Oct 21 18:55:11 Paper ovpn-client[1150]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Oct 21 18:55:11 Paper ovpn-client[1150]: PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 192.168.20.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
Oct 21 18:55:11 Paper ovpn-client[1150]: OPTIONS IMPORT: timers and/or timeouts modified
Oct 21 18:55:11 Paper ovpn-client[1150]: OPTIONS IMPORT: --ifconfig/up options modified
Oct 21 18:55:11 Paper ovpn-client[1150]: OPTIONS IMPORT: route options modified
Oct 21 18:55:11 Paper ovpn-client[1150]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Oct 21 18:55:11 Paper ovpn-client[1150]: OPTIONS IMPORT: peer-id set
Oct 21 18:55:11 Paper ovpn-client[1150]: OPTIONS IMPORT: adjusting link_mtu to 1624
Oct 21 18:55:11 Paper ovpn-client[1150]: OPTIONS IMPORT: data channel crypto options modified
Oct 21 18:55:11 Paper ovpn-client[1150]: Data Channel: using negotiated cipher 'AES-256-GCM'
Oct 21 18:55:11 Paper ovpn-client[1150]: Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
Oct 21 18:55:11 Paper ovpn-client[1150]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 21 18:55:11 Paper ovpn-client[1150]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 21 18:55:11 Paper ovpn-client[1150]: ROUTE_GATEWAY 192.168.122.1/255.255.255.0 IFACE=enp1s0 HWADDR=52:54:00:67:78:ca
Oct 21 18:55:11 Paper kernel: [  742.489583] tun: Universal TUN/TAP device driver, 1.6
Oct 21 18:55:11 Paper ovpn-client[1150]: TUN/TAP device tun0 opened
Oct 21 18:55:11 Paper ovpn-client[1150]: TUN/TAP TX queue length set to 100
Oct 21 18:55:11 Paper ovpn-client[1150]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip link set dev tun0 up mtu 1500
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2110] manager: (tun0): new Tun device (/org/freedesktop/NetworkManager/Devices/3)
Oct 21 18:55:11 Paper systemd-udevd[1156]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Oct 21 18:55:11 Paper ovpn-client[1150]: /etc/openvpn/update-systemd-resolved tun0 1500 1552 10.8.0.6 10.8.0.5 init
Oct 21 18:55:11 Paper systemd-sysctl[1162]: Line is not an assignment at '/etc/sysctl.d/99-sysctl.conf:84': k
Oct 21 18:55:11 Paper systemd-udevd[1156]: Process '/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/tun0 --prefix=/net/ipv4/neigh/tun0 --prefix=/net/ipv6/conf/tun0 --prefix=/net/ipv6/neigh/tun0' failed with exit code 1.
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2604] device (tun0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2654] keyfile: add connection /run/NetworkManager/system-connections/tun0.nmconnection (ec19d15f-cb82-4ea3-a64a-be5df74d5721,"tun0")
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2785] device (tun0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2792] device (tun0): Activation: starting connection 'tun0' (ec19d15f-cb82-4ea3-a64a-be5df74d5721)
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2793] device (tun0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2795] device (tun0): state change: prepare -> config (reason 'none', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2797] device (tun0): state change: config -> ip-config (reason 'none', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2799] device (tun0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2803] device (tun0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.2804] device (tun0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'external')
Oct 21 18:55:11 Paper NetworkManager[423]: <info>  [1603302911.3878] device (tun0): Activation: successful, device activated.
Oct 21 18:55:11 Paper dbus-daemon[420]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.service' requested by ':1.17' (uid=0 pid=423 comm="/usr/sbin/NetworkManager --no-daemon ")
Oct 21 18:55:11 Paper update-systemd-resolved: Link 'tun0' coming up
Oct 21 18:55:11 Paper openvpn[1150]: <14>Oct 21 18:55:11 update-systemd-resolved: Link 'tun0' coming up
Oct 21 18:55:11 Paper systemd[1]: Starting Network Manager Script Dispatcher Service...
Oct 21 18:55:11 Paper update-systemd-resolved: Adding DNS Routed Domain .
Oct 21 18:55:11 Paper openvpn[1150]: <14>Oct 21 18:55:11 update-systemd-resolved: Adding DNS Routed Domain .
Oct 21 18:55:11 Paper update-systemd-resolved: Adding IPv4 DNS Server 208.67.222.222
Oct 21 18:55:11 Paper openvpn[1150]: <14>Oct 21 18:55:11 update-systemd-resolved: Adding IPv4 DNS Server 208.67.222.222
Oct 21 18:55:11 Paper update-systemd-resolved: Adding IPv4 DNS Server 208.67.220.220
Oct 21 18:55:11 Paper dbus-daemon[420]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Oct 21 18:55:11 Paper systemd[1]: Started Network Manager Script Dispatcher Service.
Oct 21 18:55:11 Paper nm-dispatcher: req:1 'up' [tun0]: new request (1 scripts)
Oct 21 18:55:11 Paper nm-dispatcher: req:1 'up' [tun0]: start running ordered scripts...
Oct 21 18:55:11 Paper openvpn[1150]: <14>Oct 21 18:55:11 update-systemd-resolved: Adding IPv4 DNS Server 208.67.220.220
Oct 21 18:55:11 Paper nm-dispatcher: req:2 'connectivity-change': new request (1 scripts)
Oct 21 18:55:11 Paper update-systemd-resolved: SetLinkDNS(3 2 2 4 208 67 222 222 2 4 208 67 220 220)
Oct 21 18:55:11 Paper openvpn[1150]: <14>Oct 21 18:55:11 update-systemd-resolved: SetLinkDNS(3 2 2 4 208 67 222 222 2 4 208 67 220 220)
Oct 21 18:55:11 Paper nm-dispatcher: req:2 'connectivity-change': start running ordered scripts...
Oct 21 18:55:11 Paper update-systemd-resolved: SetLinkDomains(3 1 . true)
Oct 21 18:55:11 Paper openvpn[1150]: <14>Oct 21 18:55:11 update-systemd-resolved: SetLinkDomains(3 1 . true)
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip route add 10.10.10.10/32 via 192.168.122.1
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip route add 192.168.10.0/24 via 10.8.0.5
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip route add 192.168.20.0/24 via 10.8.0.5
Oct 21 18:55:11 Paper ovpn-client[1150]: /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Oct 21 18:55:11 Paper ovpn-client[1150]: GID set to nogroup
Oct 21 18:55:11 Paper ovpn-client[1150]: UID set to nobody
Oct 21 18:55:11 Paper ovpn-client[1150]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Oct 21 18:55:11 Paper ovpn-client[1150]: Initialization Sequence Completed
Oct 21 18:55:11 Paper PackageKit: get-updates transaction /195_bdecbcbb from uid 1000 finished with success after 351ms
Oct 21 18:55:12 Paper PackageKit: get-updates transaction /196_baeccced from uid 1000 finished with success after 288ms
Oct 21 18:55:21 Paper systemd[1]: NetworkManager-dispatcher.service: Succeeded.
Oct 21 18:55:40 Paper systemd-timesyncd[343]: Synchronized to time server for the first time 85.199.214.102:123 (2.debian.pool.ntp.org).

TinCanTech

Try removing

user nobody
group nogroup

from your client config.