Debian 10 Client

PLBarton

Hello all, I have been running an ubuntu 18.04 openvpn server for quite sometime. I use PC-Engines APU2s to connect as clients to the server and this has been working flawlessly for quite some time. I am now looking to upgrade my clients to Debian 10 and the systemctl has really kicked my butt!

I know my client side openvpn configuration is working since I can execute it from the command line calling my client.conf. However when I attempt to use systemctl to auto start openvpn is will start, then timeout and restart over and over, never fully starting.

systemctl status openvpn@client.service

● openvpn@client.service - OpenVPN connection to client
Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Fri 2020-10-23 15:45:28 CDT; 12min ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 3223 (code=exited, status=0/SUCCESS)

Oct 23 15:45:20 client systemd[1]: Starting OpenVPN connection to client...
Oct 23 15:45:28 client systemd[1]: openvpn@client.service: Succeeded.
Oct 23 15:45:28 client systemd[1]: Stopped OpenVPN connection to client.

journalctl -xe:

-- The job identifier is 3127.

Oct 23 15:43:48 client systemd-udevd[3181]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
Oct 23 15:45:15 client systemd[1]: openvpn@client.service: Start operation timed out. Terminating.
Oct 23 15:45:15 client systemd[1]: openvpn@client.service: Failed with result 'timeout'.

Something that I have noticed is that the PID list in systemctl status does not match what openvpn process is actually running on.

Before I start posting more detailed config files I wanted to see if this is something someone has experience with.

Maybe I should be posting this in a systemd forum instead, but I figured I would start here.

TinCanTech

PLBarton wrote Maybe I should be posting this in a systemd forum instead, but I figured I would start here.

Here is more appropriate.

You should be using openvpn-server@server.service and openvpn-client@client.service files.

Also, set --verb 4 in your config and check your openvpn log file for errors.

PLBarton

Okay, so I switched to openvpn-client@client.service and updated verb 4.

Here are the results.

systemctl status openvpn-client@client.service

● openvpn-client@client.service - OpenVPN tunnel for client
Loaded: loaded (/lib/systemd/system/openvpn-client@.service; enabled; vendor preset: enabled)
Active: failed (Result: timeout) since Sat 2020-10-24 10:21:27 CDT; 23s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Process: 3930 ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config client.conf (code=exited, status=0/SUCCESS)
Main PID: 3930 (code=exited, status=0/SUCCESS)

Oct 24 10:21:27 client openvpn[3930]: SIOCDELRT: Operation not permitted
Oct 24 10:21:27 client openvpn[3930]: ERROR: Linux route delete command failed: external program exited with error status: 7
Oct 24 10:21:27 client openvpn[3930]: Closing TUN/TAP interface
Oct 24 10:21:27 client openvpn[3930]: /usr/sbin/ifconfig tun0 0.0.0.0
Oct 24 10:21:27 client openvpn[3930]: SIOCSIFADDR: Operation not permitted
Oct 24 10:21:27 client openvpn[3930]: SIOCSIFFLAGS: Operation not permitted
Oct 24 10:21:27 client openvpn[3930]: Linux ip addr del failed: external program exited with error status: 255
Oct 24 10:21:27 client openvpn[3930]: SIGTERM[hard,] received, process exiting
Oct 24 10:21:27 client systemd[1]: openvpn-client@client.service: Failed with result 'timeout'.
Oct 24 10:21:27 client systemd[1]: Failed to start OpenVPN tunnel for client.

journalctl -xe

Oct 24 10:20:00 client openvpn[3930]: /usr/sbin/route add -net 10.109.0.0 netmask 255.255.0.0 gw 10.109.7.37
Oct 24 10:20:00 client openvpn[3930]: GID set to nogroup
Oct 24 10:20:00 client openvpn[3930]: UID set to nobody
Oct 24 10:20:00 client openvpn[3930]: Initialization Sequence Completed
Oct 24 10:21:27 client systemd[1]: openvpn-client@client.service: Start operation timed out. Terminating.

Crazy thing is when I start the tunnel I am able to ping across it successfully, but then systemd says 'timed out' and the tunnel is shutdown.

TinCanTech

Need to see your openvpn log.

Pippin

Remove

user nobody
group nobody

from your config file and try again.

Example, name config file: config1.conf
Place it in

/etc/openvpn/client/

.
Autostart:

systemctl enable openvpn-client@config1

.
Manual start:

systemctl start openvpn-client@config1

.
Disable Autostart:

systemctl disable openvpn-client@config1

.
Manual stop:

systemctl stop openvpn-client@config1

.
For server:

/etc/openvpn/server/

systemctl ..... openvpn-server@.....

PLBarton

OpenVPN log

https://pastebin.com/wQPEpbkV

systemctl status openvpn-client@client1

● openvpn-client@client1.service - OpenVPN tunnel for client1
Loaded: loaded (/lib/systemd/system/openvpn-client@.service; enabled; vendor preset: enabled)
Active: failed (Result: timeout) since Sat 2020-10-24 13:53:45 CDT; 14min ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Process: 544 ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config client1.conf (code=exited, status=0/SUCCESS)
Main PID: 544 (code=exited, status=0/SUCCESS)

Oct 24 13:52:15 client systemd[1]: Starting OpenVPN tunnel for client1...
Oct 24 13:53:45 client systemd[1]: openvpn-client@client1.service: Start operation timed out. Terminating.
Oct 24 13:53:45 client systemd[1]: openvpn-client@client1.service: Failed with result 'timeout'.
Oct 24 13:53:45 client systemd[1]: Failed to start OpenVPN tunnel for client1.

journalctl -xe

The job identifier is 413.
Oct 24 13:52:15 Portage systemd[1]: Starting OpenVPN tunnel for client1...
-- Subject: A start job for unit openvpn-client@client1.service has begun execution
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit openvpn-client@client1.service has begun execution.
--
-- The job identifier is 354.
Oct 24 13:52:18 client kernel: tun: Universal TUN/TAP device driver, 1.6
Oct 24 13:52:18 client systemd-udevd[549]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
Oct 24 13:53:45 client systemd[1]: openvpn-client@client1.service: Start operation timed out. Terminating.
Oct 24 13:53:45 client systemd[1]: openvpn-client@client1.service: Failed with result 'timeout'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- The unit openvpn-client@client1.service has entered the 'failed' state with result 'timeout'.
Oct 24 13:53:45 Portage systemd[1]: Failed to start OpenVPN tunnel for client1.
-- Subject: A start job for unit openvpn-client@client1.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit openvpn-client@client1.service has finished with a failure.
--
-- The job identifier is 354 and the job result is failed.

And once again I am able to successfully ping across the tunnel once I start it before it times out.

Thanks for all your help.

TinCanTech

PLBarton wroteOpenVPN log

OpenVPN 2.3.11 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Aug 30 2020
library versions: OpenSSL 1.0.2u-fips 20 Dec 2019, LZO 2.10

Where did you get that ?

PLBarton

compiled it myself. But like I said. If I launch from command line it works flawlessly.

TinCanTech

I doubt 2.3 has support for systemd ..

PLBarton

Thank you! I did not even consider that. As soon as I reverted to a newer version it worked.

TinCanTech

PLBarton wrote As soon as I reverted to a newer version

:mrgreen: