-
kaushalshriyan
- OpenVPN User
- Posts: 22
- Joined: Thu Sep 08, 2016 9:43 am
Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Hi,
I have upgraded openvpn 2.4.9 (openvpn-2.4.9-1.el7.x86_64) to openvpn-2.5.0-1.el7.x86_64 on CentOS Linux release 7.8.2003 (Core) by referring to https://copr.fedorainfracloud.org/coprs … n-release/
OpenVPN 2.5.0 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 28 2020
library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.06
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=yes enable_comp_stub=no enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=yes enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no
I am mentioning the /etc/openvpn/server.conf configuration file which is as below :-
Server Config
#
server 10.8.0.0 255.255.255.0
verb 3
key /etc/openvpn/server.key
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
dh /etc/openvpn/dh.pem
keepalive 10 120
persist-key
persist-tun
push «redirect-gateway def1»
push «dhcp-option DNS 8.8.8.8»
push «dhcp-option DNS 8.8.4.4»
push «route 192.168.0.0 255.255.255.0»
duplicate-cn
user nobody
group nobody
proto tcp
port 1195
dev tun
status /var/log/openvpn-status.log 60
status-version 2
log-append openvpn.log
While restarting OpenVPN server using systemctl restart openvpn-server@server.service command on CentOS Linux release 7.8.2003 (Core), I am encountering the below issue as shown in /var/log/messages file.
Nov 1 10:54:46 openvpn systemd: Stopped OpenVPN service for server.
Nov 1 10:54:46 openvpn systemd: Starting OpenVPN service for server…
Nov 1 10:54:46 openvpn openvpn: Note: Treating option ‘—ncp-ciphers’ as ‘—data-ciphers’ (renamed in OpenVPN 2.5).
Nov 1 10:54:46 openvpn openvpn: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Nov 1 10:54:46 openvpn openvpn: Use —help for more information.
Nov 1 10:54:46 openvpn systemd: openvpn-server@server.service: main process exited, code=exited, status=1/FAILURE
Nov 1 10:54:46 openvpn systemd: Failed to start OpenVPN service for server.
Nov 1 10:54:46 openvpn systemd: Unit openvpn-server@server.service entered failed state.
Nov 1 10:54:46 openvpn systemd: openvpn-server@server.service failed.
Nov 1 10:54:51 openvpn systemd: openvpn-server@server.service holdoff time over, scheduling restart.
Nov 1 10:54:51 openvpn systemd: Stopped OpenVPN service for server.
Nov 1 10:54:51 openvpn systemd: Starting OpenVPN service for server…
Nov 1 10:54:51 openvpn openvpn: Note: Treating option ‘—ncp-ciphers’ as ‘—data-ciphers’ (renamed in OpenVPN 2.5).
Nov 1 10:54:51 openvpn openvpn: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Nov 1 10:54:51 openvpn openvpn: Use —help for more information.
Nov 1 10:54:51 openvpn systemd: openvpn-server@server.service: main process exited, code=exited, status=1/FAILURE
Nov 1 10:54:51 openvpn systemd: Failed to start OpenVPN service for server.
Nov 1 10:54:51 openvpn systemd: Unit openvpn-server@server.service entered failed state.
Nov 1 10:54:51 openvpn systemd: openvpn-server@server.service failed.
Any help will be highly appreciated. Thanks in Advance. Please let me know if you need any additional details.
Best Regards,
Kaushal
-
wpyung
- OpenVpn Newbie
- Posts: 2
- Joined: Wed Nov 11, 2020 4:51 pm
Re: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Post
by wpyung » Wed Nov 11, 2020 4:57 pm
I have a similar problem, although actually the VPN is working..
I’m pretty sure its this issue: https://github.com/Nyr/openvpn-install/issues/654
Does anyone know if this issue has been fixed ?
I am using openvpn candidate 2.4.4-2ubuntu1.3
This is being used by our small company so that people can work remotely from home.
We are getting repeated messages in log as shown below, approximately every 5 seconds.
These prevent me from debugging the connection, which drops for a few seconds occasionally.
Nov 11 16:11:28 vm8 systemd[1]: openvpn-server@server.service.service: Service hold-off time over, scheduling restart.
Nov 11 16:11:28 vm8 systemd[1]: openvpn-server@server.service.service: Scheduled restart job, restart counter is at 4034009.
Nov 11 16:11:28 vm8 systemd[1]: Stopped OpenVPN service for server.service.
Nov 11 16:11:28 vm8 systemd[1]: Starting OpenVPN service for server.service…
Nov 11 16:11:28 vm8 openvpn[11582]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.service.conf
Nov 11 16:11:28 vm8 openvpn[11582]: Use —help for more information.
Nov 11 16:11:28 vm8 systemd[1]: openvpn-server@server.service.service: Main process exited, code=exited, status=1/FAILURE
Nov 11 16:11:28 vm8 systemd[1]: openvpn-server@server.service.service: Failed with result ‘exit-code’.
Nov 11 16:11:28 vm8 systemd[1]: Failed to start OpenVPN service for server.service.
-
TinCanTech
- OpenVPN Protagonist
- Posts: 11142
- Joined: Fri Jun 03, 2016 1:17 pm
Re: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Post
by TinCanTech » Wed Nov 11, 2020 5:45 pm
wpyung wrote: ↑
Wed Nov 11, 2020 4:57 pm
Error opening configuration file: server.service.conf
Are you sure of that name ?
-
300000
- OpenVPN Expert
- Posts: 688
- Joined: Tue May 01, 2012 9:30 pm
Re: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Post
by 300000 » Wed Nov 11, 2020 7:18 pm
there is no server.conf file so openvpn cant start it or file permission not set so openvpn cant read it. , check the file again maybe it have been delete on update to new one
Содержание
- Почему не стартует OpenVPN
- FIX — Error opening configuration file: server.conf #654
- Comments
- Запуск OpenVPN
- Options error in cmd line 1 error opening configuration file server conf
- Google завершил December 2022 Helpful Content update и Link Spam update
- Трафик по осени считают. Как продвигать сезонные товары, чтобы помочь продажам
Почему не стартует OpenVPN
Всю голову поломал не могу понять что ему нужно пишу в консоли: /etc/init.d/openvpn start
В ответ получаю
[ ok ] Starting openvpn (via systemctl): openvpn.service.
Смотрю в процессах нет никакого намека на него. Иду дальше
запращиваю статус systemctl status openvpn
В ответ получаю
openvpn.service — OpenVPN service
Loaded: loaded (/lib/systemd/system/openvpn.service; enabled) Active: active (exited) since Пт 2016-07-08 15:59:45 CEST; 1min 11s ago Process: 32548 ExecStart=/bin/true (code=exited, status=0/SUCCESS) Main PID: 32548 (code=exited, status=0/SUCCESS) CGroup: /system.slice/openvpn.service
июл 08 15:59:45 server systemd[1]: Started OpenVPN service. июл 08 15:59:52 server systemd[1]: Started OpenVPN service.
Делаю поиск по pidу
ps axu | grep 32548
В ответ получаю
root 556 0.0 0.0 14444 980 pts/0 S+ 16:02 0:00 grep 32548
Смотрю syslog
Jul 8 16:04:27 server systemd[1]: Stopping OpenVPN service.
Jul 8 16:04:27 server systemd[1]: Starting OpenVPN service.
Что ему надо подскажите
смотри openvpn.log (который указан в conf файле), либо запусти напрямую в консоли.
И всё у тебя будет пучком
В ответ получил
● openvpn@server.service — OpenVPN connection to server
Loaded: loaded (/lib/systemd/system/openvpn@.service; disabled)
Active: failed (Result: exit-code) since Пт 2016-07-08 16:27:37 CEST; 6s ago
Process: 2540 ExecStart=/usr/sbin/openvpn —daemon ovpn-%i —status /run/openvpn/%i.status 10 —cd /etc/openvpn —config /etc/openvpn/%i.conf (code=exited, status=1/FAILURE)
июл 08 16:27:37 server systemd[1]: openvpn@server.service: control process exited, code=exited status=1
июл 08 16:27:37 server systemd[1]: Failed to start OpenVPN connection to server.
июл 08 16:27:37 server systemd[1]: Unit openvpn@server.service entered failed state.
Он пустой в том то и дело
Конфиг лежит в /etc/openvpn/server.conf ?
запусти вручную openvpn —config /path/to/openvpn.conf
Я понял про конфиг уже, переименовал вот что щас пишет
● openvpn@server.service — OpenVPN connection to server
Loaded: loaded (/lib/systemd/system/openvpn@.service; disabled)
Active: failed (Result: exit-code) since Пт 2016-07-08 16:32:18 CEST; 1min 48s ago
Process: 2947 ExecStart=/usr/sbin/openvpn —daemon ovpn-%i —status /run/openvpn/%i.status 10 —cd /etc/openvpn —config /etc/openvpn/%i.conf (code=exited, status=1/FAILURE)
июл 08 16:32:18 server ovpn-server[2947]: Options error: In [CMD-LINE]:1: Error opening configuration file: /etc/openvpn/server.conf
июл 08 16:32:18 server systemd[1]: openvpn@server.service: control process exited, code=exited status=1
июл 08 16:32:18 server systemd[1]: Failed to start OpenVPN connection to server.
июл 08 16:32:18 server systemd[1]: Unit openvpn@server.service entered failed state.
покажи содержимое /etc/default/openvpn
Вобще не реагирует
Права на конфиг какие? Дропает ли демон свои привилегии до nobody:nobody ?
# This is the configuration file for /etc/init.d/openvpn
# # Start only these VPNs automatically via init script.
# Allowed values are «all», «none» or space separated list of
# names of the VPNs. If empty, «all» is assumed.
# The VPN name refers to the VPN configutation file name.
# i.e. «home» would be /etc/openvpn/home.conf
#
# If you’re running systemd, changing this variable will
# require running «systemctl daemon-reload» followed by
# a restart of the openvpn service (if you removed entries
# you may have to stop those manually)
#
#AUTOSTART=«all»
#AUTOSTART=«none»
#AUTOSTART=«home office»
#
# WARNING: If you’re running systemd the rest of the
# options in this file are ignored.
#
# Refresh interval (in seconds) of default status files
# located in /var/run/openvpn.$NAME.status
# Defaults to 10, 0 disables status file generation
#
#STATUSREFRESH=10
#STATUSREFRESH=0
# Optional arguments to openvpn’s command line
OPTARGS=«»
#
# If you need openvpn running after sendsigs, i.e.
# to let umountnfs work over the vpn, set OMIT_SENDSIGS
# to 1 and include umountnfs as Required-Stop: in openvpn’s
# init.d script (remember to run insserv after that)
#
OMIT_SENDSIGS=0
/etc/openvpn# ls -l
итого 24
drwxr-xr-x 2 root root 4096 июл 4 05:00 easy-rsa
drwxr-xr-x 2 root root 4096 июл 4 04:56 keys
drwxr-xr-x 2 root root 4096 июл 8 14:40 log
drwxr-xr-x 2 root root 4096 июл 4 05:06 script
-rwxrwxrwx 1 root root 942 июл 8 16:32 server.conf
-rwxr-xr-x 1 root root 1301 ноя 12 2015 update-resolv-conf
С правами все хорошо специально поставил даже 777
Что-то шибко мелкий какой-то конф файл, он там точно не пустой у тебя?
mode server
##protocol port
port 1194
proto tcp
dev tap
##ip server client
server 10.4.0.0 255.255.255.0
##key ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
##option
persist-key
persist-tun
keepalive 5 60
reneg-sec 432000
##option authen.
comp-lzo
user nobody
#group nogroup
client-to-client
username-as-common-name
client-cert-not-required
auth-user-pass-verify /etc/openvpn/script/login.sh via-env
##push to client
max-clients 50
push «persist-key»
push «persist-tun»
push «redirect-gateway def1»
#push «explicit-exit-notify 1»
##DNS-Server
push «dhcp-option DNS 8.8.8.8»
push «dhcp-option DNS 8.8.4.4»
Источник
FIX — Error opening configuration file: server.conf #654
Recurring problem on fresh Centos 7 installations:
service openvpn@server status -l
Redirecting to /bin/systemctl status -l openvpn@server.service
● openvpn@server.service — OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Thu 2019-09-12 20:04:37 EDT; 17s ago
Process: 11239 ExecStart=/usr/sbin/openvpn —cd /etc/openvpn/ —config %i.conf (code=exited, status=1/FAILURE)
Main PID: 11239 (code=exited, status=1/FAILURE)
Sep 12 20:04:37 server.masked.com systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server.
Sep 12 20:04:37 server.masked.com openvpn[11239]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Sep 12 20:04:37 server.masked.com openvpn[11239]: Use —help for more information.
Sep 12 20:04:37 server.masked.com systemd[1]: openvpn@server.service: main process exited, code=exited, status=1/FAILURE
Sep 12 20:04:37 server.masked.com systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
Sep 12 20:04:37 server.masked.com systemd[1]: Unit openvpn@server.service entered failed state.
Sep 12 20:04:37 server.masked.com systemd[1]: openvpn@server.service failed.
The text was updated successfully, but these errors were encountered:
Источник
Запуск OpenVPN
Centos7 Проблемы на самом деле у меня две: Первая —
openvpn —config /etc/openvpn/server.conf — так openvpn запускается и клиент коннектится
systemctl start openvpn@server — так выпадает с ошибкой
systemctl status openvpn@server
● openvpn@u7wrm89.service — OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Fri 2018-07-13 06:51:18 EDT; 13s ago
Process: 2324 ExecStart=/usr/sbin/openvpn —cd /etc/openvpn/ —config %i.conf (code=exited, status=1/FAILURE)
Main PID: 2324 (code=exited, status=1/FAILURE)
Jul 13 06:51:18 server systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server.
Jul 13 06:51:18 server openvpn[2324]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Jul 13 06:51:18 server openvpn[2324]: Use —help for more information.
Jul 13 06:51:18 server systemd[1]: openvpn@server.service: main process exited, code=exited, status=1/FAILURE
Jul 13 06:51:18 server systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
Jul 13 06:51:18 server systemd[1]: Unit openvpn@server.service entered failed state.
Jul 13 06:51:18 server systemd[1]: openvpn@server.service failed.
Feriwalld выключен, SElinux тоже.
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing — SELinux security policy is enforced.
# permissive — SELinux prints warnings instead of enforcing.
# disabled — No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted — Targeted processes are protected,
# minimum — Modification of targeted policy. Only selected processes are protected.
# mls — Multi Level Security protection.
SELINUXTYPE=targeted
cat /var/log/openvpn.log
Fri Jul 13 06:52:21 2018 OpenVPN 2.4.6 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 26 2018
Fri Jul 13 06:52:21 2018 library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.06
Fri Jul 13 06:52:21 2018 Diffie-Hellman initialized with 2048 bit key
Fri Jul 13 06:52:21 2018 TUN/TAP device tun0 opened
Fri Jul 13 06:52:21 2018 TUN/TAP TX queue length set to 100
Fri Jul 13 06:52:21 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Jul 13 06:52:21 2018 /sbin/ip link set dev tun0 up mtu 1500
Fri Jul 13 06:52:21 2018 /sbin/ip addr add dev tun0
192.168.50.1/24 broadcast 192.168.50.255
Fri Jul 13 06:52:21 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Jul 13 06:52:21 2018 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Jul 13 06:52:21 2018 UDPv4 link local (bound): [AF_INET][undef]:1194
Fri Jul 13 06:52:21 2018 UDPv4 link remote: [AF_UNSPEC]
Fri Jul 13 06:52:21 2018 GID set to nobody
Fri Jul 13 06:52:21 2018 UID set to nobody
Fri Jul 13 06:52:21 2018 MULTI: multi_init called, r=256 v=256
Fri Jul 13 06:52:21 2018 IFCONFIG POOL: base=192.168.50.2 size=252, ipv6=0
Fri Jul 13 06:52:21 2018 IFCONFIG POOL LIST
Fri Jul 13 06:52:21 2018 Initialization Sequence Completed
Fri Jul 13 06:52:28 2018 event_wait : Interrupted system call (code=4)
Fri Jul 13 06:52:29 2018 event_wait : Interrupted system call (code=4)
Fri Jul 13 06:52:29 2018 Closing TUN/TAP interface
Fri Jul 13 06:52:29 2018 /sbin/ip addr del dev tun0
192.168.50.1/24 RTNETLINK answers: Operation not permitted
Fri Jul 13 06:52:29 2018 Linux ip addr del failed: external program exited with error status: 2
Fri Jul 13 06:52:29 2018 SIGINT[hard,] received, process exiting
Вторая — палится IP провайдера моего, а не ВПН. Но это надо NAT и iptables. Мне бы пока с первым решить.
Источник
Options error in cmd line 1 error opening configuration file server conf
- Поисковые системы
- Яндекс
- Каталоги сайтов
- Прочие поисковики
- Агрегаторы и доски объявлений
- Практика оптимизации
- Общие вопросы оптимизации
- Частные вопросы — ранжирование, индексация, бан
- Сервисы и программы для работы с SE
- Любые вопросы от новичков по оптимизации
- Ссылочные и пользовательские факторы
- Поисковые технологии
- Doorways & Cloaking
- Трафик для сайтов
- Поисковая и контекстная реклама
- Google Adwords
- Яндекс.Директ
- Тизерная и баннерная реклама
- Общие вопросы рекламы
- Монетизация сайтов
- Партнерские программы в Интернете
- Контекстная реклама
- Google AdSense
- Рекламная Сеть Яндекса
- Размещение тизерной и баннерной рекламы
- Общие вопросы
- Сайтостроение
- Веб-строительство
- Статистика и аналитика
- Доменные имена
- Администрирование серверов
- Хостинг
- Безопасность
- Usability и удержание посетителей
- Копирайтинг
- Социальный Маркетинг
- Вконтакте
- YouTube
- Facebook & Instagram
- TikTok
- Telegram
- Общие вопросы
- Общение профессионалов
- Семинары и конференции
- eCommerce, интернет-магазины и электронная коммерция
- Телефония и коммуникации для бизнеса
- Деловые вопросы
- Финансы
- Cчет в Яндекс.Деньгах
- Криптовалюты
- Инвестиции
- Экономика
- Правовые вопросы
- Биржа и продажа
- Финансовые объявления
- Работа на постоянной основе
- Сайты — покупка, продажа
- Соцсети: страницы, группы, приложения
- Сайты без доменов
- Трафик, тизерная и баннерная реклама
- Продажа, оценка, регистрация доменов
- Ссылки — обмен, покупка, продажа
- Программы и скрипты
- Размещение статей
- Инфопродукты
- Прочие цифровые товары
- Работа и услуги для вебмастера
- Оптимизация, продвижение и аудит
- Ведение рекламных кампаний
- Услуги в области SMM
- Программирование
- Администрирование серверов и сайтов
- Прокси, ВПН, анонимайзеры, IP
- Платное обучение, вебинары
- Регистрация в каталогах
- Копирайтинг, переводы
- Дизайн
- Usability: консультации и аудит
- Изготовление сайтов
- Наполнение сайтов
- Прочие услуги
- Не про работу
- О сайте и форуме
- Самое разное
- Курилка
- Встречи и сходки
- Железо и софт
Google завершил December 2022 Helpful Content update и Link Spam update
Трафик по осени считают. Как продвигать сезонные товары, чтобы помочь продажам
Добрый день, а подскажите плз кто сталкивался, пытаюсь запустить на 7 центозе 2 openvpn сервера.
раньше можно было использовать
сейчас почему то на 7ке отказывается читать вообще все кроме единственного server.conf
кто в курсе где там подправить можно стартовый скрипт?
по тому как редактирование
мне не помогло. все равно пытается искать server.conf
вообще странно конечно.
а в содержимом openvpn@server.service
[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target
[Service]
PrivateTmp=true
Type=forking
PIDFile=/var/run/openvpn/%i.pid
ExecStart=/usr/sbin/openvpn —daemon —writepid /var/run/openvpn/%i.pid —cd /etc/openvpn/ —config %i.conf
то есть по идее он все должен .conf файлы читать.
или %i.conf это пред определенный server.conf ?
тогда как заменить ? пробовал на % и * не хочет.
Источник
I can’t start openvpn server for systemd. When I type # systemctl start openvpn@server.service I have got error:
# journalctl -b -u openvpn@server.service
sie 14 12:07:38 blubajt systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server…
sie 14 12:07:38 blubajt openvpn[46795]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
sie 14 12:07:38 blubajt openvpn[46795]: Use —help for more information.
sie 14 12:07:38 blubajt systemd[1]: openvpn@server.service: main process exited, code=exited, status=1/FAILURE
sie 14 12:07:38 blubajt systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
sie 14 12:07:38 blubajt systemd[1]: Unit openvpn@server.service entered failed state.
sie 14 12:07:38 blubajt systemd[1]: openvpn@server.service failed.
But when I run openvpn from cli as root# openvpn —config /etc/openvpn/server/server.conf it starts properly, new interface tun0 is showing up. I didn’t try to connect but from logs it looks like it’s working. I installed openvpn from epel-release repo. My unit file looks like this:
# cat /usr/lib/systemd/system/openvpn-server@.service
[Unit]
Description=OpenVPN service for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/w … n24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn —status %t/openvpn-server/status-%i.log —status-version 2 —suppress-timestamps —config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure
[Install]
WantedBy=multi-user.target
cat /etc/openvpn/server/server.conf
#################################################
# Sample OpenVPN 2.0 config file for #
# multi-client server. #
# #
# This file is for the server side #
# of a many-clients <-> one-server #
# OpenVPN configuration. #
# #
# OpenVPN also supports #
# single-machine <-> single-machine #
# configurations (See the Examples page #
# on the web site for more info). #
# #
# This config should work on Windows #
# or Linux/BSD systems. Remember on #
# Windows to quote pathnames and use #
# double backslashes, e.g.: #
# «C:\Program Files\OpenVPN\config\foo.key» #
# #
# Comments are preceded with ‘#’ or ‘;’ #
#################################################
# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 11194
# TCP or UDP server?
;proto tcp
proto udp
# «dev tun» will create a routed IP tunnel,
# «dev tap» will create an ethernet tunnel.
# Use «dev tap0» if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use «dev-node» for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one. On XP SP2 or higher,
# you may need to selectively disable the
# Windows firewall for the TAP adapter.
# Non-Windows systems usually don’t need this.
;dev-node MyTap
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
#
# See the «easy-rsa» directory for a series
# of scripts for generating RSA certificates
# and private keys. Remember to use
# a unique Common Name for the server
# and each of the client certificates.
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see «pkcs12» directive in man page).
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh2048.pem 2048
dh dh2048.pem
# Network topology
# Should be subnet (addressing via IP)
# unless Windows clients v2.0.9 and lower have to
# be supported (then net30, i.e. a /30 per client)
# Defaults to net30 (not recommended)
topology subnet
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 192.168.10.0 255.255.255.0
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt
# Configure server mode for ethernet bridging.
# You must first use your OS’s bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0. Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
# Configure server mode for ethernet bridging
# using a DHCP-proxy, where clients talk
# to the OpenVPN server-side DHCP server
# to receive their IP address allocation
# and DNS server addresses. You must first use
# your OS’s bridging capability to bridge the TAP
# interface with the ethernet NIC interface.
# Note: this mode only works on clients (such as
# Windows), where the client-side TAP adapter is
# bound to a DHCP client.
;server-bridge
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push «route 192.168.10.0 255.255.255.0»
;push «route 192.168.20.0 255.255.255.0»
# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory «ccd» for client-specific
# configuration files (see man page for more info).
# EXAMPLE: Suppose the client
# having the certificate common name «Thelonious»
# also has a small subnet behind his connecting
# machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248
# This will allow Thelonious’ private subnet to
# access the VPN. This example will only work
# if you are routing, not bridging, i.e. you are
# using «dev tun» and «server» directives.
# EXAMPLE: Suppose you want to give
# Thelonious a fixed VPN IP address of 10.9.0.1.
# First uncomment out these lines:
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
# Then add this line to ccd/Thelonious:
# ifconfig-push 10.9.0.1 10.9.0.2
# Suppose that you want to enable different
# firewall access policies for different groups
# of clients. There are two methods:
# (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface
# for each group/daemon appropriately.
# (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access
# from different clients. See man
# page for more info on learn-address script.
;learn-address ./script
# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push «redirect-gateway def1 bypass-dhcp»
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
push «dhcp-option DNS 208.67.222.222»
push «dhcp-option DNS 208.67.220.220»
# Uncomment this directive to allow different
# clients to be able to «see» each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server’s TUN/TAP interface.
client-to-client
# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE «COMMON NAME»,
# UNCOMMENT THIS LINE OUT.
;duplicate-cn
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 120
# For extra security beyond that provided
# by SSL/TLS, create an «HMAC firewall»
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn —genkey —secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be ‘0’
# on the server and ‘1’ on the clients.
;tls-auth ta.key 0 # This file is secret
tls-crypt myvpn.tlsauth
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
# Note that v2.4 client/server will automatically
# negotiate AES-256-GCM in TLS mode.
# See also the ncp-cipher option in the manpage
cipher AES-256-GCM
# Enable compression on the VPN link and push the
# option to the client (v2.4+ only, for earlier
# versions see below)
;compress lz4-v2
push «compress lz4-v2»
# For compression compatible with older clients use comp-lzo
# If you enable it here, you must also
# enable it in the client config file.
;comp-lzo
# The maximum number of concurrently connected
# clients we want to allow.
max-clients 10
# It’s a good idea to reduce the OpenVPN
# daemon’s privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
user nobody
group nobody
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the «Program FilesOpenVPNlog» directory).
# Use log or log-append to override this default.
# «log» will truncate the log file on OpenVPN startup,
# while «log-append» will append to it. Use one
# or the other (but not both).
;log openvpn.log
log-append openvpn.log
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 9
# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20
# Notify the client that when the server restarts so it
# can automatically reconnect.
;explicit-exit-notify 1
remote-cert-eku «TLS Web Client Authentication»
# ls -la /etc/openvpn/server/
razem 92
drwxr-x—. 2 root openvpn 4096 08-13 21:04 .
drwxr-xr-x. 4 root root 4096 08-13 20:55 ..
-rw-r—r—. 1 root root 1310 08-13 15:45 ca.crt
-rw-r—r—. 1 root root 424 08-13 16:25 dh2048.pem
-rw-r—r—. 1 root root 0 08-13 21:11 ipp.txt
-rw-r—r—. 1 root root 636 08-13 15:30 myvpn.tlsauth
-rw——-. 1 root root 45667 08-13 21:11 openvpn.log
-rw-r—r—. 1 root root 232 08-13 21:10 openvpn-status.log
-rw-r—r—. 1 root root 10856 08-13 19:19 server.conf
-rw-r—r—. 1 root root 1554 08-13 16:21 server.crt
-rw-r—r—. 1 root root 3243 08-13 16:24 server.key
I do not have more ideas what could be wrong. Please help.
Добрый день, а подскажите плз кто сталкивался, пытаюсь запустить на 7 центозе 2 openvpn сервера.
раньше можно было использовать
server01.conf
server02.conf
итд.
сейчас почему то на 7ке отказывается читать вообще все кроме единственного server.conf
кто в курсе где там подправить можно стартовый скрипт?
по тому как редактирование
/etc/systemd/system/multi-user.target.wants/openvpn@server.service
мне не помогло… все равно пытается искать server.conf
———- Добавлено 29.04.2015 в 14:34 ———-
вообще странно конечно.
root@server:/etc/openvpn# ls
easy-rsa ipp.txt server_tcp.conf server_udp.conf
root@server:/etc/openvpn#
но при запуске.
Apr 29 11:31:59 server.domain.com openvpn[3146]: Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
Apr 29 11:31:59 server.domain.com openvpn[3146]: Use —help for more information.
Apr 29 11:31:59 server.domain.com systemd[1]: openvpn@server.service: control process exited, code=exited status=1
Apr 29 11:31:59 server.domain.com systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
— Subject: Unit openvpn@server.service has failed
а в содержимом openvpn@server.service
[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target
[Service]
PrivateTmp=true
Type=forking
PIDFile=/var/run/openvpn/%i.pid
ExecStart=/usr/sbin/openvpn —daemon —writepid /var/run/openvpn/%i.pid —cd /etc/openvpn/ —config %i.conf
[Install]
WantedBy=multi-user.target
то есть по идее он все должен .conf файлы читать.
или %i.conf это пред определенный server.conf ?
тогда как заменить ? пробовал на % и * не хочет.
———- Добавлено 29.04.2015 в 15:34 ———-
разобрался…
хотя про это нигде и не пишут особо.
нагуглить тяжеловато.
ln -s /lib/systemd/system/openvpn@.service /etc/systemd/system/multi-user.target.wants/openvpn@server.service (Note that ‘server’ corresponds with the configuration name in /etc/openvpn/ such as server.conf; that is, ‘server’ corresponds to whatever name your configuration file has)
в общем лошадка просто запрягалась.
systemctl enable openvpn@server_udp.service
systemctl enable openvpn@server_tcp.service