I'm new to Ubuntu (as in, last week!) and really liking the system, but am having a real problem getting the OpenVPN connection to work.
My system:
- DELL XPS L702X, 8Gb RAM, tested with both WiFi and wired connection.
- Ubuntu 12.10, updates current.
- OpenVPN + the Gnome-openvpn network manager added.
I have a pre-existing configuration and associated certificates + keys from my Win7 install, which I have copied first to /home/documents and then (after a bit of reading around) to /etc/openvpn (using sudo).
That configuration and key set has been working successfully for several years on Windows with OpenVPN 2.2.x. (latterly 2.2.2).
Trying Network Manager first, I created a VPN connection of type OpenVPN, using Certificates (TLS) mode and specified the server certificate, my certificate, my key, the static key and set to use TAP, etc., (to match the server config), and set Route only for the resources on that network.
I exported the configuration to compare to my original one and the settings seem to match exactly (although it adds "user openvpn" and "group openvpn").
Trying to start the VPN from Network Manager I see the padlock "blink" about 4 times then get a "failed" pop-up message.
Running the conf from the Terminal using either:
sudo openvpn --config /etc/openvpn/COPE.conf
or
sudo /etc/init.d/openvpn start COPE
I get the following output, which looks remarkably like the connection log from my Win7 install:
Mon Feb 18 14:09:56 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 8 2012 Mon Feb 18 14:09:56 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Mon Feb 18 14:09:56 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Mon Feb 18 14:09:56 2013 Control Channel Authentication: using '/etc/openvpn/hmacf-w.key' as a OpenVPN static key file Mon Feb 18 14:09:56 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Feb 18 14:09:56 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Feb 18 14:09:56 2013 LZO compression initialized Mon Feb 18 14:09:56 2013 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ] Mon Feb 18 14:09:56 2013 Socket Buffers: R=[212992->131072] S=[212992->131072] Mon Feb 18 14:09:56 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ] Mon Feb 18 14:09:56 2013 Local Options hash (VER=V4): '13a273ba' Mon Feb 18 14:09:56 2013 Expected Remote Options hash (VER=V4): '360696c5' Mon Feb 18 14:09:56 2013 UDPv4 link local: [undef] Mon Feb 18 14:09:56 2013 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:8991 Mon Feb 18 14:09:56 2013 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:8991, sid=c1da4711 85037ca7 Mon Feb 18 14:09:56 2013 VERIFY OK: depth=1, /C=UK/ST=Nottinghamshire/L=Nottingham/O=COPE/CN=COPE-CA/[email protected] Mon Feb 18 14:09:56 2013 VERIFY OK: depth=0, /C=UK/ST=Nottinghamshire/O=COPE/CN=server/[email protected] Mon Feb 18 14:09:56 2013 Replay-window backtrack occurred [1] Mon Feb 18 14:09:56 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Feb 18 14:09:56 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Feb 18 14:09:56 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Feb 18 14:09:56 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Feb 18 14:09:56 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA Mon Feb 18 14:09:56 2013 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:8991 Mon Feb 18 14:09:58 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Mon Feb 18 14:09:58 2013 PUSH: Received control message: 'PUSH_REPLY,route-gateway dhcp,ping 10,ping-restart 120' Mon Feb 18 14:09:58 2013 OPTIONS IMPORT: timers and/or timeouts modified Mon Feb 18 14:09:58 2013 OPTIONS IMPORT: route-related options modified Mon Feb 18 14:09:58 2013 TUN/TAP device tap0 opened Mon Feb 18 14:09:58 2013 TUN/TAP TX queue length set to 100 Mon Feb 18 14:09:58 2013 /etc/openvpn/update-resolv-conf tap0 1500 1574 init Mon Feb 18 14:09:58 2013 Initialization Sequence Completed
... but no ping to the target network works.
Also, listing ifconfig, there is no sign of the tap0 connection device.
I have tried using Gufw to add a rule to allow anything from my source server, but that made no difference.
I have tried commenting out all of the script in update-resolv-conf (thinking being that I didn't use this in Windows, so maybe not needed for my connection type?) - but this made no difference.
I'm stumped. So far as I can tell I have configured Network Manager (and my /etc/openvpn/COPE.conf file) correctly to match my server.
Is this a problem for 12.10?
My server is running ovpn 2.2.1 and I do not explicitly indicate cipher type (uses defaults).
I've been reading all the other posts for the last three days and nothing has given a solution (although I've learned a fair amount!)
All help suggestions very much appreciated.
Thanks
