Пытаюсь настоить NM на работе с openvpn. И судя по логам подключение проходит, те с ключами\сертификатами все ок. Но:
1. tun0 в дауне после подключения
2. через какое то время соединение рвется так и не получив IP
3. если сделать ifup то прилетают ipv6 (и работают), но не прилетают ipv4 (от dhcp)
4. если ipv4 задать руками, то все работет до того времени пока nm не порвет подключение по таймауту
5. если взять голый openvpn то подключение проходит и работет. Проблема именно в nm (а хочется мышкой тыкать)
Mar 10 12:11:11 eth0 NetworkManager[936]: <info> Starting VPN service 'openvpn'...
Mar 10 12:11:11 eth0 NetworkManager[936]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 19832
Mar 10 12:11:11 eth0 NetworkManager[936]: <info> VPN service 'openvpn' appeared; activating connections
Mar 10 12:11:11 eth0 NetworkManager[936]: <info> VPN plugin state changed: init (1)
Mar 10 12:11:11 eth0 NetworkManager[936]: <info> VPN plugin state changed: starting (3)
Mar 10 12:11:11 eth0 NetworkManager[936]: <info> VPN connection 'openvpn' (Connect) reply received.
Mar 10 12:11:12 eth0 nm-openvpn[19835]: OpenVPN 2.3.2 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014
Mar 10 12:11:12 eth0 nm-openvpn[19835]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mar 10 12:11:12 eth0 nm-openvpn[19835]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mar 10 12:11:12 eth0 nm-openvpn[19835]: WARNING: file '/home/user/eth0.key' is group or others accessible
Mar 10 12:11:12 eth0 nm-openvpn[19835]: UDPv4 link local: [undef]
Mar 10 12:11:12 eth0 nm-openvpn[19835]: UDPv4 link remote: [AF_INET]1.2.2.1:1194
Mar 10 12:11:12 eth0 nm-openvpn[19835]: [ox] Peer Connection Initiated with [AF_INET]1.2.2.1:1194
Mar 10 12:11:14 eth0 nm-openvpn[19835]: TUN/TAP device tap0 opened
Mar 10 12:11:14 eth0 nm-openvpn[19835]: /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper tap0 1500 1590 init
Mar 10 12:11:14 eth0 NetworkManager[936]: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/tap0, iface: tap0)
Mar 10 12:11:14 eth0 NetworkManager[936]: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/tap0, iface: tap0): no ifupdown configuration found.
Mar 10 12:11:14 eth0 NetworkManager[936]: <warn> /sys/devices/virtual/net/tap0: couldn't determine device driver; ignoring...
Mar 10 12:11:14 eth0 NetworkManager[936]: <info> VPN connection 'openvpn' (IP Config Get) reply received.
Mar 10 12:11:14 eth0 nm-openvpn[19835]: Initialization Sequence Completed
Тут интерфейс лежит. если поднять то случается:
Mar 10 12:11:19 eth0 avahi-daemon[857]: Joining mDNS multicast group on interface tap0.IPv6 with address fe80::4ecf.
Mar 10 12:11:19 eth0 avahi-daemon[857]: New relevant interface tap0.IPv6 for mDNS.
Mar 10 12:11:19 eth0 avahi-daemon[857]: Registering new address record for fe80::4ecf on tap0.*.
Mar 10 12:11:21 eth0 avahi-daemon[857]: Leaving mDNS multicast group on interface tap0.IPv6 with address fe80::4ecf.
Mar 10 12:11:21 eth0 avahi-daemon[857]: Joining mDNS multicast group on interface tap0.IPv6 with address 2002::df74.
Mar 10 12:11:21 eth0 avahi-daemon[857]: Registering new address record for 2002::df74 on tap0.*.
Mar 10 12:11:21 eth0 avahi-daemon[857]: Withdrawing address record for fe80::4ecf on tap0.
Mar 10 12:11:21 eth0 avahi-daemon[857]: Registering new address record for 2002::4ecf on tap0.*.
Вот тут рвется по таймауту
Mar 10 12:11:52 eth0 NetworkManager[936]: <warn> VPN connection 'openvpn' (IP Config Get) timeout exceeded.
Mar 10 12:11:52 eth0 NetworkManager[936]: <info> Policy set '2.5.3.2' (eth1) as default for IPv4 routing and DNS.
Mar 10 12:11:52 eth0 avahi-daemon[857]: Interface tap0.IPv6 no longer relevant for mDNS.
Mar 10 12:11:52 eth0 avahi-daemon[857]: Leaving mDNS multicast group on interface tap0.IPv6 with address 2002::df74.
Mar 10 12:11:52 eth0 avahi-daemon[857]: Withdrawing address record for 2002::4ecf on tap0.
Mar 10 12:11:52 eth0 avahi-daemon[857]: Withdrawing address record for 2002::df74 on tap0.
Mar 10 12:11:52 eth0 avahi-daemon[857]: Withdrawing workstation service for tap0.
Mar 10 12:11:52 eth0 NetworkManager[936]: <warn> (16) failed to find interface name for index
Mar 10 12:11:52 eth0 nm-openvpn[19835]: SIGTERM[hard,] received, process exiting
Mar 10 12:11:52 eth0 NetworkManager[936]: nm_system_iface_flush_routes: assertion 'iface != NULL' failed
Mar 10 12:11:52 eth0 NetworkManager[936]: <warn> (16) failed to find interface name for index
Mar 10 12:11:52 eth0 NetworkManager[936]: SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/tap0, iface: tap0)
Mar 10 12:11:57 eth0 NetworkManager[936]: <info> VPN service 'openvpn' disappeared
Логи с сервера
Mar 10 15:14:17 rt-n16 openvpn[22174]: MULTI: multi_create_instance called
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Re-using SSL/TLS context
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 LZO compression initialized
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Local Options hash (VER=V4): '26e19fc0'
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Expected Remote Options hash (VER=V4): 'b498be7c'
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 TLS: Initial packet from 2.5.3.2:59214, sid=ee01fb5c f6ba6975
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 VERIFY OK: depth=1, /C=RU/ST=74/L=Chelyabinsk/O=ox/OU=ox/CN=ox_CA/emailAddress=dis@me
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 VERIFY OK: depth=0, /C=RU/ST=74/L=Chelyabinsk/O=ox/OU=eth0/CN=eth0/emailAddress=dis@me
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mar 10 15:14:17 rt-n16 openvpn[22174]: 2.5.3.2:59214 [eth0] Peer Connection Initiated with 2.5.3.2:59214
Mar 10 15:14:17 rt-n16 openvpn[22174]: eth0/2.5.3.2:59214 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_b74e20888a3cb758b5766b793215ca5p
Mar 10 15:14:17 rt-n16 openvpn[22174]: eth0/2.5.3.2:59214 MULTI: no dynamic or static remote --ifconfig address is available for eth0/2.5.3.2:59214
Mar 10 15:14:19 rt-n16 openvpn[22174]: eth0/2.5.3.29:59214 PUSH: Received control message: 'PUSH_REQUEST'
Mar 10 15:14:19 rt-n16 openvpn[22174]: eth0/2.5.3.2:59214 SENT CONTROL [eth0]: 'PUSH_REPLY,route-gateway dhcp,route-gateway dhcp,ping 10,ping-restart 60' (stat)
Mar 10 15:14:38 rt-n16 openvpn[22174]: eth0/2.5.3.2:59214 MULTI: Learn: 36:1f:06:ef:c5:46 -> eth0/2.5.3.2:59214
Mar 10 15:14:57 rt-n16 openvpn[22174]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Конфиг сервера
dev tap0
proto udp
server-bridge
push "route-gateway dhcp"
script-security 2
client-connect ./openvpn.up
tls-server
dh dh1024.pem
ca ca.crt
cert ox.crt
key ox.key
port 1194
mode server
client-to-client
comp-lzo
persist-tun
persist-key
verb 3
keepalive 10 60
В NM стоят галки: LZO, TAP, AES-128-CBC, Remore peer cert TLS: Server. IP задать руками нельзя. по этому стоит автоматом.
Куда копать?
