ConnMan VPN support in OSMC

After I failed to setup VPN connection with PPTP-client, I tried with ConnMan - here’s what I did:

  1. installed connman-vpn
    sudo apt-get install connman-vpn

  2. enabled (and started) the service
    sudo systemctl enable connman-vpn.service

  3. created VPN configuration file following these specs and saved it under /var/lib/connman-vpn/my_vpn.config
    [global]
    Name = vpn
    Description = VPN configuration
    [provider_pptp]
    Type = PPTP
    Name = my_vpn
    Host = x.xxx.xxx.xxx
    Domain =
    PPTP.User = username
    PPTP.Password = password
    PPPD.RequirMPPE128
    PPPD.NoBSDComp
    PPPD.NoDeflate

  4. now, when I run connmanctl> services I don’t see my vpn listed there, so I’m not able to actually try and connect to the vpn…

Q: Is this approach I described above going to work at all with OSMC? If yes, what am I missing?

Is the service running ?

sudo systemctl status connman-vpn.service

Enabling a service only sets it to start on next boot, if you also want it to start immediately without a reboot you would also do:

sudo systemctl start connman-vpn.service

PS I have not used connman-vpn.service before so I am just providing general suggestions.

Hi

Mixing Debian’s connman packages and ours is not a good idea, but we will investigate what is needed to get VPN running.

Sam

This is really a great news @sam_nazarko - thank you :smile:

Yes - I made sure the service was running, but I’m sure there’s much more to configure to get this working, as the connman-vpn has not been originally implemented in osmc.

I’m seeing the following entry in OSMC’s December update note:

- Fix an issue preventing some VPN clients from working properly

Is it possible now to use connman-vpn with OSMC? Has anyone tried to setup VPN using ConnMan? Any help will be appreciated.

Thanks
sew

Hey guys - can anyone confirm if OSMC already has everything that is needed for ConnMan VPN to work? Or is it a waste of time for me trying to set it up right with current OSMC release?

Thanks
sew

It has the connection manager (ConnMan) and we build it with VPN support. It can be configured manually, via an editor. What we don’t, presently offer, but hope to do so eventually, is offer a graphical interface for this.

A lot of users are configuring OpenVPN with /etc/init.d. This won’t work properly, as a connection manager’s duty is to handle routing. This messes with OpenVPN’s routing changes. Put shortly: ConnMan needs to be aware of OpenVPN. There’s nothing to prevent this, but I suspect a lack of documentation / guides has resulted in users falling back to the stock OpenVPN guides.

Sam

Please help!!! :slightly_smiling:

I created a new vpn.config file at /var/lib/connman-vpn/vpn.config :

[provider_l2tp] Type=L2TP Name=UK1 Host=myvpn.vpn.com Domain=my.home L2TP.User=myusername L2TP.Password=mypassword L2TP.IPSecSaref=yes;

Now, when I run connman-vpn daemon and point it to the config file (connman-vpnd -c /var/lib/connman-vpn/vpn.config -n -d), I get the following error:

connman-vpnd[575]: vpn/vpn-config.c:load_provider() Cannot create provider from config file (19/No such device)
connman-vpnd[575]: Config file /var/lib/connman-vpn/vpn.config does not contain any configuration that can be provisioned!

Any idea where I got this wrong?
Thanks!

Here’s the full log/output of: # connman-vpnd -n -d

root@osmc:~# connman-vpnd -n -d
connman-vpnd[490]: Connection Manager VPN daemon version 1.21
connman-vpnd[490]: src/dbus.c:__connman_dbus_init()
connman-vpnd[490]: src/inotify.c:__connman_inotify_init()
connman-vpnd[490]: src/agent.c:__connman_agent_init()
connman-vpnd[490]: vpn/vpn-provider.c:__vpn_provider_init()
connman-vpnd[490]: src/agent.c:connman_agent_driver_register() Registering driver 0x49684 name vpn
connman-vpnd[490]: vpn/vpn-manager.c:__vpn_manager_init()
connman-vpnd[490]: vpn/vpn-ipconfig.c:__vpn_ipconfig_init()
connman-vpnd[490]: vpn/vpn-rtnl.c:__vpn_rtnl_init()
connman-vpnd[490]: src/task.c:__connman_task_init()
connman-vpnd[490]: src/plugin.c:__connman_plugin_init()
connman-vpnd[490]: vpn/vpn-provider.c:vpn_provider_driver_register() driver 0xc95e9c name openconnect
connman-vpnd[490]: vpn/vpn-provider.c:provider_create_all_from_type() provider type openconnect
connman-vpnd[490]: vpn/vpn-provider.c:vpn_provider_driver_register() driver 0xc8db1c name openvpn
connman-vpnd[490]: vpn/vpn-provider.c:provider_create_all_from_type() provider type openvpn
connman-vpnd[490]: vpn/vpn-config.c:__vpn_config_init()
connman-vpnd[490]: src/inotify.c:create_watch() Add directory watch for /var/lib/connman-vpn
connman-vpnd[490]: vpn/vpn-config.c:read_configs() path /var/lib/connman-vpn
connman-vpnd[490]: vpn/vpn-config.c:create_config() ident vpn
connman-vpnd[490]: Adding configuration vpn
connman-vpnd[490]: vpn/vpn-config.c:load_config() config 0xc8dd30
connman-vpnd[490]: src/storage.c:storage_load() Loading /var/lib/connman-vpn/vpn.config
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key Type value PPTP
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key Name value myVPN
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key Host value vpn.com
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key PPTP.User value username
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key PPTP.Password value password
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key Domain value vpn
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key PPPD.ReqMPPE128 value true
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key PPPD.RefuseCHAP value true
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key PPD.RefuseMSCHAP value true
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key PPPD.RefusePAP value true
connman-vpnd[490]: vpn/vpn-config.c:set_string() provider 0xc8e390 key PPPD.RefuseEAP value true
connman-vpnd[490]: vpn/vpn-config.c:get_string() provider 0xc8e390 key Host
connman-vpnd[490]: vpn/vpn-config.c:get_string() provider 0xc8e390 key Domain
connman-vpnd[490]: vpn/vpn-config.c:load_provider() provider identifier vpn_com_vpn
connman-vpnd[490]: vpn/vpn-provider.c:get_string() settings 0xc86278 key Type
connman-vpnd[490]: vpn/vpn-provider.c:get_string() settings 0xc86278 key Name
connman-vpnd[490]: vpn/vpn-provider.c:get_string() settings 0xc86278 key Host
connman-vpnd[490]: vpn/vpn-provider.c:get_string() settings 0xc86278 key Domain
connman-vpnd[490]: vpn/vpn-provider.c:get_string() settings 0xc86278 key Networks
connman-vpnd[490]: vpn/vpn-provider.c:__vpn_provider_create_from_config() type PPTP name myVPN networks (null)
connman-vpnd[490]: vpn/vpn-provider.c:__vpn_provider_create_from_config() ident vpn_com_vpn
connman-vpnd[490]: vpn/vpn-provider.c:vpn_provider_new() provider 0xc8e610
connman-vpnd[490]: vpn/vpn-provider.c:provider_initialize() provider 0xc8e610
connman-vpnd[490]: vpn/vpn-provider.c:vpn_provider_get() provider 0xc8e610
connman-vpnd[490]: vpn/vpn-provider.c:configuration_count_add() count 1
connman-vpnd[490]: vpn/vpn-provider.c:provider_probe() provider 0xc8e610 driver (nil) name myVPN
connman-vpnd[490]: vpn/vpn-provider.c:provider_resolv_host_addr() Trying to resolv vpn.com
connman-vpnd[490]: vpn/vpn-provider.c:vpn_provider_ref_debug() 0xc8e610 ref 2 by vpn/vpn-provider.c:577:provider_resolv_host_addr()
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key PPPD.RefuseEAP immutable yes value true
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key Name immutable yes value myVPN
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key Host immutable yes value vpn.com
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key PPTP.User immutable yes value username
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key PPPD.RefusePAP immutable yes value true
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key PPPD.RefuseCHAP immutable yes value true
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key PPTP.Password immutable yes value password
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key PPPD.ReqMPPE128 immutable yes value true
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key Domain immutable yes value vpn
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key Type immutable yes value PPTP
connman-vpnd[490]: vpn/vpn-provider.c:set_string() provider 0xc8e610 key PPD.RefuseMSCHAP immutable yes value true
connman-vpnd[490]: vpn/vpn-provider.c:vpn_provider_save() provider 0xc8e610 immutable yes
connman-vpnd[490]: vpn/vpn-provider.c:provider_probe() provider 0xc8e610 driver (nil) name myVPN
connman-vpnd[490]: vpn/vpn-config.c:load_provider() Cannot create provider from config file (19/No such device)
connman-vpnd[490]: Config file /var/lib/connman-vpn/vpn.config does not contain any configuration that can be provisioned!
connman-vpnd[490]: vpn/vpn-rtnl.c:__vpn_rtnl_start()
connman-vpnd[490]: lo {newlink} index 1 operstate 0 <UNKNOWN>
connman-vpnd[490]: eth0 {create} index 2 type 1 <ETHER>
connman-vpnd[490]: eth0 {update} flags 102467 <UP,RUNNING,LOWER_UP>
connman-vpnd[490]: eth0 {newlink} index 2 address B8:27:EB:E9:A2:03 mtu 1500
connman-vpnd[490]: eth0 {newlink} index 2 operstate 6 <UP>
connman-vpnd[490]: vpn/vpn-provider.c:resolv_result() status 0
connman-vpnd[490]: vpn/vpn-provider.c:vpn_provider_unref_debug() 0xc8e610 ref 1 by vpn/vpn-provider.c:549:resolv_result()

and the config file has the following content:

[global]
Name=myVPN

[provider_pptp]
Type=PPTP
Name=myVPN
Host=vpn.com
PPTP.User=username
PPTP.Password=password
Domain=vpn
PPPD.ReqMPPE128=true
PPPD.RefuseCHAP=true
PPD.RefuseMSCHAP=true
PPPD.RefusePAP=true
PPPD.RefuseEAP=true

This is one of the reasons why I removed connman and went back to if updown. I use the raspi as a nfs server for another pi wired directly on eth0 using volumio. Connman did not bring eth0 up if no connection was detected, so if the other pi was shut down when I restarted the osmc the dhcp server failed to start. Moreover kept messing up with routings setting default on eth0 if for some reason the wifi went down. Add to this that was also randomly disrupting routing when openvpn was running and you complete the picture.
Ah, no, theres is more, it has an internal dhcp server he uses when enabling tethering but there is no way (at least that I found) to simply enable it on eth0.

Frankly I do not know if it is worth the pain to have a connection manager at the same time so invasive and so limited on a pi. It would be useful in case of hotplug of network interfaces, or on a mobile device where it can take care of wifi but not on a small media box which is fundamentally configured at installation and then will keep that config forever.
The configuration done by ifupdown and wireless-tools is easier, less invasive and less error prone.

For you yes, and that’s great. But not for 99% of users that want to set up WiFi or Bluetooth, and don’t want to know what wpa-supplicant or bluez are, it’s far, far worse. From a programmatic perspective, it’s also very bad.

ConnMan can run VPN – our issue is we haven’t got a GUI tool for this yet. Changing to yet another headless mechanism for maintaining network connections won’t alleviate that.

Sam

With ifupdown you do not need to know what wpa supplicant is, wpa-essid and wpa-psk in iface definition do the magic. It is even simpler than connman.
About bluetooh, I’ve never used it so I can’t speak.

/etc/network/interfaces does not allow for multiple connections (easily), which can make roaming more challenging.

See [HOWTO] OSMC/Rasp Pi as OpenVPN client - #35 by sam_nazarko for more about VPN, ConnMan and /etc/network/interfaces. The only issues with ConnMan seem to be raised by VPN users. They would be better served working with us to get VPN working with ConnMan, then everyone wins :slightly_smiling:

What made me run away from connman is that he kept changing default route to isolated eth0 randomly. I have wlan0 in dhcp connected to router, eth0 is static and serving a volumio, finally openvpn opening a tun0 that has been blacklisted. Usually everything works, but sometimes connman decided to set eth0 as default route and nothing worked anymore until manual intervention.
I tried to reproduce, nothing, tried to debug but kernel was still flooding log with those gpio messages so at the end saying goodbye to connman was the easiest thing.
IMHO is too much of not fish nor flesh. Not smart enough for basic users and not flexible enough for advanced ones, and the big winning point of OSMC on Openelec is that the OS behind OSMC is much more open and configurable.

You’re basing this on one need, which ConnMan is currently not satisfying for you. If you look at what it does do right, you’ll see that is a lot. As I say, we will eventually add a GUI interface for configuring ConnMan, for now there isn’t a perfect solution.

ConnMan should not be producing GPIO messages – can you post a snippet so I can see what you mean?

ConnMan handles routing, as it’s a connection manager. You can ‘ignore’ devices with -I and thus ConnMan won’t mess with them.

Power users have /etc/network/interfaces, and always will with OSMC. So if you do prefer it, that’s fine and I am glad you have at least some form of a solution

Sam

Thank you @sam_nazarko and @pronto89 for contributing to this thread. However, I didn’t get too much from your conversation, except for realizing that I’m still a rookie in linux world… :blush:

But at least I know now, that trying to get the VPN working with ConnMan is out of my reach right now - so thanks for saving my time!

VPN on OSMC is quite important for me. I event tried my luck with XBian - I did setup the VPN with no issue, but after two days of struggling with the whole system, I was back on OSMC. OpenELEC is not really an option, because it doesn’t have that openness, which OSMC and XBian have (which I need for configuring print server on my Pi). However, it seems that OpenELEC also uses ConnMan and they offer a GUI for configuring VPN (openvpn and pptp - afaik), so I hope it’s just a matter of time and OSMC will offer that too :slightly_smiling:

So, I guess I’ll just stick to OSMC and patiently wait for developers to add GUI or someone wiser that me to post some step-by-step guide on how to get the VPN working (pptp or l2tp) with ConnMan, as there’s no better alternative to OSMC right now. I’m just a bit surprised that so little people need VPN on their media box… Or, they’ve already found a workaround for that… but if that requires removing ConnMan, I’m not sure if that’s a good option for less-experienced users like me…

Thanks all,
sew

Sam, the GPIO messages were coming from kernel driver of my wireless dongle. You already solved this issue but it was present when I tried to figure out what was happening with WiFi.

Sew, what are your networking needs?
Pi connecting to internet via wireless or wired?
Vpn on pptp/l2tp or openvpn would be also ok?
Do you need to hotplug any network adapter, or you have your pi confortably sitting hidden behind your tv?

I’m using wired connection only. Unfortunately, I’m limited to using only PPTP, L2TP, SSTP or SoftEther (cannot use OpenVPN with my vpn provider). No need to hotplug anything. I hardly ever touch my Pi - it stays ON for most of the time.

Thanks
sew

Have you tried adding
NetworkInterfaceBlacklist=eth0,ppp0

Configuring eth0 through a couple of lines in /etc/network/interfaces and using the pptp client as in your other post should then work as connman SHOULD at that point just sit there idling.

No, I haven’t tried that… But to make sure I understand what you’re saying:

  1. Add NetworkInterfaceBlacklist=eth0,ppp0 to /etc/connman.conf, which will tell ConnMan to ignore these interfaces?

  2. Configure eth0 in /etc/network/interfaces - will such basic setup work?:
    auto eth0 iface eth0 inet static address 192.0.2.7 netmask 255.255.255.0 gateway 192.0.2.254

  3. Setup VPN with pptp-linux client (which used to work with Raspbmc and Network Manager)?

What are the drawbacks of such solution? Should I expect any issues or instability with the system or network?