Page MenuHomeVyOS Platform

OpenVPN failing silently for a number of reasons in rolling post Nov/02
Closed, ResolvedPublicBUG

Description

So I suspect openvpn was upgraded when it was ported over to python as this is the same config I've been using for years:

openvpn vtun0 {
    encryption {
        cipher aes256gcm
    }
    keep-alive {
        failure-count 3
        interval 10
    }
    mode server
    openvpn-option "tls-auth /config/auth/openvpn/ta.key 0"
    server {
        name-server 10.53.53.53
        name-server 10.53.53.54
        push-route 0.0.0.0/0
        subnet 10.7.178.0/24
    }
    tls {
        ca-cert-file /config/auth/openvpn/domain.com.crt
        cert-file /config/auth/openvpn/vpn.domain.com.crt
        dh-file /config/auth/openvpn/dh4096.pem
        key-file /config/auth/openvpn/vpn.domain.com.key
    }
    use-lzo-compression
}

The first problem was the

openvpn-option "tls-auth /config/auth/openvpn/ta.key 0"

I know those aren't validated, but considering it's the precise thing that the tls block option drops in the file, I'm not sure why it was failing. In any case, moving that to the tls block make that work. It still caused openvpn to not start without any indication.

The next problem was the keep-alive stuff that failed with the following error:

Nov 21 17:37:37 edge openvpn-vtun0[12401]: DEPRECATED OPTION: --compat-names, please update your configuration. This will be removed in OpenVPN 2.5.
Nov 21 17:37:37 edge openvpn-vtun0[12401]: Options error: the second parameter to --keepalive (restart timeout=3) must be at least twice the value of the first parameter (ping interval=10).  A ratio of 1:5 or 1:6 would be even better.  Recommended setting is --keepalive 10 60.
Nov 21 17:37:37 edge openvpn-vtun0[12401]: Use --help for more information.
Nov 21 17:37:37 edge systemd[1]: openvpn@vtun0.service: Main process exited, code=exited, status=1/FAILURE
Nov 21 17:37:37 edge systemd[1]: openvpn@vtun0.service: Failed with result 'exit-code'.
Nov 21 17:37:37 edge systemd[1]: Failed to start OpenVPN connection to vtun0.

Also note the compat-names deprecation warning.

Details

Difficulty level
Normal (likely a few hours)
Version
1.3
Why the issue appeared?
Implementation mistake
Is it a breaking change?
Perfectly compatible

Event Timeline

pasik added a subscriber: pasik.Sat, Nov 21, 6:11 PM
c-po changed the task status from Open to In progress.Sun, Nov 22, 8:49 AM
c-po claimed this task.
c-po triaged this task as High priority.
c-po changed Difficulty level from Unknown (require assessment) to Normal (likely a few hours).
c-po changed Why the issue appeared? from Will be filled on close to Implementation mistake.
c-po changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
c-po changed the task status from In progress to Needs testing.Sun, Nov 22, 9:41 AM
c-po closed this task as Resolved.Mon, Nov 23, 9:19 AM

We will deal with the compat-names warning once starting on VyOS 1.4 ;)

c-po moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus board.Mon, Nov 23, 3:59 PM