Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm new to Ubuntu (as in, last week!) and really liking the system, but am having a real problem getting the OpenVPN connection to work.

My system:

  • DELL XPS L702X, 8Gb RAM, tested with both WiFi and wired connection.
  • Ubuntu 12.10, updates current.
  • OpenVPN + the Gnome-openvpn network manager added.

I have a pre-existing configuration and associated certificates + keys from my Win7 install, which I have copied first to /home/documents and then (after a bit of reading around) to /etc/openvpn (using sudo).

That configuration and key set has been working successfully for several years on Windows with OpenVPN 2.2.x. (latterly 2.2.2).

Trying Network Manager first, I created a VPN connection of type OpenVPN, using Certificates (TLS) mode and specified the server certificate, my certificate, my key, the static key and set to use TAP, etc., (to match the server config), and set Route only for the resources on that network.

I exported the configuration to compare to my original one and the settings seem to match exactly (although it adds "user openvpn" and "group openvpn").

Trying to start the VPN from Network Manager I see the padlock "blink" about 4 times then get a "failed" pop-up message.

Running the conf from the Terminal using either:

sudo openvpn --config /etc/openvpn/COPE.conf

or

sudo /etc/init.d/openvpn start COPE

I get the following output, which looks remarkably like the connection log from my Win7 install:

Mon Feb 18 14:09:56 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct  8 2012
Mon Feb 18 14:09:56 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Feb 18 14:09:56 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Feb 18 14:09:56 2013 Control Channel Authentication: using '/etc/openvpn/hmacf-w.key' as a OpenVPN static key file
Mon Feb 18 14:09:56 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 18 14:09:56 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 18 14:09:56 2013 LZO compression initialized
Mon Feb 18 14:09:56 2013 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb 18 14:09:56 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Feb 18 14:09:56 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Feb 18 14:09:56 2013 Local Options hash (VER=V4): '13a273ba'
Mon Feb 18 14:09:56 2013 Expected Remote Options hash (VER=V4): '360696c5'
Mon Feb 18 14:09:56 2013 UDPv4 link local: [undef]
Mon Feb 18 14:09:56 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:8991
Mon Feb 18 14:09:56 2013 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:8991, sid=c1da4711 85037ca7
Mon Feb 18 14:09:56 2013 VERIFY OK: depth=1, /C=UK/ST=Nottinghamshire/L=Nottingham/O=COPE/CN=COPE-CA/emailAddress=security@.com
Mon Feb 18 14:09:56 2013 VERIFY OK: depth=0, /C=UK/ST=Nottinghamshire/O=COPE/CN=server/emailAddress=security@.com
Mon Feb 18 14:09:56 2013 Replay-window backtrack occurred [1]
Mon Feb 18 14:09:56 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 18 14:09:56 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 18 14:09:56 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 18 14:09:56 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 18 14:09:56 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Feb 18 14:09:56 2013 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:8991
Mon Feb 18 14:09:58 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb 18 14:09:58 2013 PUSH: Received control message: 'PUSH_REPLY,route-gateway dhcp,ping 10,ping-restart 120'
Mon Feb 18 14:09:58 2013 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb 18 14:09:58 2013 OPTIONS IMPORT: route-related options modified
Mon Feb 18 14:09:58 2013 TUN/TAP device tap0 opened
Mon Feb 18 14:09:58 2013 TUN/TAP TX queue length set to 100
Mon Feb 18 14:09:58 2013 /etc/openvpn/update-resolv-conf tap0 1500 1574   init
Mon Feb 18 14:09:58 2013 Initialization Sequence Completed

... but no ping to the target network works.

Also, listing ifconfig, there is no sign of the tap0 connection device.

I have tried using Gufw to add a rule to allow anything from my source server, but that made no difference.

I have tried commenting out all of the script in update-resolv-conf (thinking being that I didn't use this in Windows, so maybe not needed for my connection type?) - but this made no difference.

I'm stumped. So far as I can tell I have configured Network Manager (and my /etc/openvpn/COPE.conf file) correctly to match my server.

Is this a problem for 12.10?

My server is running ovpn 2.2.1 and I do not explicitly indicate cipher type (uses defaults).

I've been reading all the other posts for the last three days and nothing has given a solution (although I've learned a fair amount!)

All help suggestions very much appreciated.

Thanks

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.