OVPN script not working

MarchHare · 7 April 2018 19:50

After setting up my brand new 4k I decided to install the ovpn script, I followed this guide http://brianhornsby.com/blog/how-to-setup-your-vpn-client.php and a few posts on here mostly because that’s what I used on my pi3 as well.
At first it didn’t start, couldn’t find openvpn, turns out it’s in sbin not in bin.
With the exception of my file location which is /etc/openvp/ for the certs and ovpn files instead.

It says it connects but if I do an IP check with SSH wget http://ipecho.net/plain -O - -q ; echo or curl an IPcheck site it either doesn’t resolve or comes up an empty line.
example file

client
dev tun
proto udp
remote fr.privateinternetaccess.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/user.txt
comp-lzo
verb 1
reneg-sec 0
crl-verify /etc/openvpn/crl.rsa.2048.pem
ca /etc/openvpn/ca.rsa.2048.crt
disable-occ

This is what my client file looks like, user text just has my
user
pass
and everything is located in the same directory just as I have set up on my Pi.

I changed the menu to use sudo with and without a password and set the directory to sbin instead of bin.
The script says it’s connected but it isn’t.

sam_nazarko · 7 April 2018 19:51

Can you access other services like scrapers and updates?

MarchHare · 7 April 2018 19:52

I can with my normal connection. Not with the vpn on, it gets stuck on 0% during manual update.

SSH to the vero also keeps timing out randomly, out of the box I had problems finding my NFS’s too, if that helps. It didn’t go smoothly at all so I updated right away but didn’t seem to have changed much.

dillthedog · 7 April 2018 20:07

Can you post the log from Brian Hornsby’s add-on?

I think it’s probably at /home/osmc/.kodi/userdata/addon_data/script.openvpn/openvpn.log in which case you should run

paste-log /home/osmc/.kodi/userdata/addon_data/script.openvpn/openvpn.log

If it’s not there, you’ll need to look around in that general area.

MarchHare · 7 April 2018 20:17

Sat Apr 7 22:02:40 2018 OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Sat Apr 7 22:02:40 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Sat Apr 7 22:02:41 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]
Sat Apr 7 22:02:41 2018 UDP link local: (not bound)
Sat Apr 7 22:02:41 2018 UDP link remote: [AF_INET]
Sat Apr 7 22:02:41 2018 WARNING: this configuration may cache passwords in memory – use the auth-nocache option to prevent this
Sat Apr 7 22:02:41 2018 Peer Connection Initiated with [AF_INET]
Sat Apr 7 22:02:43 2018 TUN/TAP device tun0 opened
Sat Apr 7 22:02:43 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sat Apr 7 22:02:43 2018 /sbin/ip link set dev tun0 up mtu 1500
Sat Apr 7 22:02:43 2018 /sbin/ip addr add dev tun0 local 10.97.10.6 peer 10.97.10.5
Sat Apr 7 22:02:43 2018 Initialization Sequence Completed
Sat Apr 7 22:02:53 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:03:04 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:03:14 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:03:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:03:34 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:03:44 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:03:54 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:04:04 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:04:14 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:04:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:04:34 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:04:43 2018 Inactivity timeout (–ping-restart), restarting
Sat Apr 7 22:04:43 2018 SIGUSR1[soft,ping-restart] received, process restarting
Sat Apr 7 22:04:48 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]
Sat Apr 7 22:04:48 2018 UDP link local: (not bound)
Sat Apr 7 22:04:48 2018 UDP link remote: [AF_INET]
Sat Apr 7 22:04:48 2018 Peer Connection Initiated with [AF_INET]
Sat Apr 7 22:04:54 2018 AUTH: Received control message: AUTH_FAILED
Sat Apr 7 22:04:54 2018 /sbin/ip addr del dev tun0 local 10.97.10.6 peer 10.97.10.5
Sat Apr 7 22:04:54 2018 SIGTERM[soft,auth-failure] received, process exiting

dillthedog · 7 April 2018 20:23

Why didn’t you use paste-log?
You need to change verb 1 to verb 3 in the openvpn config file. I think with Brian Hornsby’s app you then need to import it (or words to that effect).

MarchHare · 7 April 2018 20:25

~$ paste-log /home/osmc/.kodi/userdata/addon_data/script.openvpn/openvpn.log
curl: Can’t open ‘/home/osmc/.kodi/userdata/addon_data/script.openvpn/openvpn.log’!
curl: try ‘curl --help’ or ‘curl --manual’ for more information
curl: Can’t open ‘/home/osmc/.kodi/userdata/addon_data/script.openvpn/openvpn.log’!
curl: try ‘curl --help’ or ‘curl --manual’ for more information
Unable to upload log. Please check your internet connection.

that’s why

I don’t think there even is a verb setting in the config by default, didn’t see it in his guide either.

MarchHare · 7 April 2018 20:26

And I keep disconnecting from SSH every 30 seconds thats pretty annoying too. Wired connection, static IP.

This is what hornsby advices on his How to by the way

clientdev tunproto udpremote us-midwest.privateinternetaccess.com 1194resolv-retry infinitenobindpersist-keypersist-tunca /home/pi/vpn-config/ca.crttls-clientremote-cert-tls serverauth-user-pass /home/pi/vpn-config/pass.txtcomp-lzoverb 1reneg-sec 0crl-verify /home/pi/vpn-config/crl.pem

Verb set to default I think.

With verb set to 3 I have the same issue

~$ wget http://ipecho.net/plain -O - -q ; echo

~$

dillthedog · 7 April 2018 20:35

I need to see the log now it’s running with verb 3. (Verb means verbosity, so more detail in the log.)

MarchHare · 7 April 2018 20:39

Sat Apr 7 22:32:08 2018 /sbin/ip addr add dev tun0 local 10.56.10.6 peer 10.56.10.5
Sat Apr 7 22:32:08 2018 Initialization Sequence Completed
Sat Apr 7 22:32:18 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:32:28 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:32:38 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:32:48 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:32:58 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:33:08 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:33:18 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:33:28 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:33:38 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:33:48 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:33:58 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:34:08 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sat Apr 7 22:34:08 2018 Inactivity timeout (–ping-restart), restarting
Sat Apr 7 22:34:08 2018 SIGUSR1[soft,ping-restart] received, process restarting
Sat Apr 7 22:34:13 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]
Sat Apr 7 22:34:13 2018 UDP link local: (not bound)
Sat Apr 7 22:34:13 2018 UDP link remote: [AF_INET]
Sat Apr 7 22:34:13 2018 Peer Connection Initiated with [AF_INET]
Sat Apr 7 22:34:19 2018 AUTH: Received control message: AUTH_FAILED
Sat Apr 7 22:34:19 2018 /sbin/ip addr del dev tun0 local 10.56.10.6 peer 10.56.10.5
Sat Apr 7 22:34:19 2018 SIGTERM[soft,auth-failure] received, process exiting

Looks like it’s less verbose on verb 3.

dillthedog · 7 April 2018 21:24

It won’t be. But you’ve lost the top part of the log.

MarchHare · 8 April 2018 03:37

This is the complete log i’m getting from verb 3, I might have cut something off by mistake.

Sun Apr 8 05:29:40 2018 OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Sun Apr 8 05:29:40 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Sun Apr 8 05:29:41 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]
Sun Apr 8 05:29:41 2018 UDP link local: (not bound)
Sun Apr 8 05:29:41 2018 UDP link remote: [AF_INET]
Sun Apr 8 05:29:41 2018 WARNING: this configuration may cache passwords in memory – use the auth-nocache option to prevent this
Sun Apr 8 05:29:41 Peer Connection Initiated with [AF_INET]
Sun Apr 8 05:29:42 2018 TUN/TAP device tun0 opened
Sun Apr 8 05:29:42 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sun Apr 8 05:29:42 2018 /sbin/ip link set dev tun0 up mtu 1500
Sun Apr 8 05:29:42 2018 /sbin/ip addr add dev tun0 local 10.68.10.6 peer 10.68.10.5
Sun Apr 8 05:29:42 2018 Initialization Sequence Completed
Sun Apr 8 05:29:52 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:30:02 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:30:12 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:30:22 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:30:32 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:30:42 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:30:52 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:31:02 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:31:12 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:31:22 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:31:32 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Sun Apr 8 05:31:42 2018 Inactivity timeout (–ping-restart), restarting
Sun Apr 8 05:31:42 2018 SIGUSR1[soft,ping-restart] received, process restarting
Sun Apr 8 05:31:47 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]185.210.218.104:1198
Sun Apr 8 05:31:47 2018 UDP link local: (not bound)
Sun Apr 8 05:31:49 2018 AUTH: Received control message: AUTH_FAILED
Sun Apr 8 05:31:49 2018 /sbin/ip addr del dev tun0 local 10.68.10.6 peer 10.68.10.5
Sun Apr 8 05:31:49 2018 SIGTERM[soft,auth-failure] received, process exiting

I thought i’d check my Pi on which it used to work just fine so I could retrace my steps but that seems to fail now as well…

Sun Apr 8 06:26:39 2018 OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] $
Sun Apr 8 06:26:39 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Sun Apr 8 06:27:19 2018 RESOLVE: Cannot resolve host address: jp.privateinternetaccess.com:1198 (Name or service not known)
Sun Apr 8 06:27:59 2018 RESOLVE: Cannot resolve host address: jp.privateinternetaccess.com:1198 (Name or service not known)
Sun Apr 8 06:27:59 2018 Could not determine IPv4/IPv6 protocol
Sun Apr 8 06:27:59 2018 SIGUSR1[soft,init_instance] received, process restarting
Sun Apr 8 06:28:44 2018 RESOLVE: Cannot resolve host address: jp.privateinternetaccess.com:1198 (Name or service not known)

So now none of the scripts seem to work while I’m sure the one on my Pi used to work just fine.

Edit: I seem to have lost WAN all together on the Pi now, Vero does have WAN, LAN works fine on both. The strange part is that I didn’t change anything in my Pi, Vero or router ofter then giving the Vero a dedicated static ip.
The only odd thing I see on my Pi on shutdown now is “A startup job is running to query time HTTP” something along those lines.

dillthedog · 8 April 2018 07:17

That’s still verbosity level 1. I believe you need to “import” the changed openvpn config into Brian Hornsby’s add-on for it to take effect.

One other small point. I downloaded at the PIA config files (http://privateinternetaccess.com/openvpn/openvpn.zip) and for France it shows a domain name of france.privateinternetaccess.com, whereas yours starts with fr.

[user@fedora-26 ~]$ nslookup fr.privateinternetaccess.com
Server:		10.137.2.1
Address:	10.137.2.1#53

** server can't find fr.privateinternetaccess.com: NXDOMAIN

[user@fedora-26 ~]$ nslookup france.privateinternetaccess.com
Server:		10.137.2.1
Address:	10.137.2.1#53

Non-authoritative answer:
Name:	france.privateinternetaccess.com
Address: 108.61.122.215
Name:	france.privateinternetaccess.com
Address: 108.61.123.66
Name:	france.privateinternetaccess.com
Address: 108.61.122.214
Name:	france.privateinternetaccess.com
Address: 108.61.122.223
Name:	france.privateinternetaccess.com
Address: 108.61.122.9
Name:	france.privateinternetaccess.com
Address: 108.61.123.69
Name:	france.privateinternetaccess.com
Address: 108.61.122.65
Name:	france.privateinternetaccess.com
Address: 108.61.123.71
Name:	france.privateinternetaccess.com
Address: 108.61.122.158
Name:	france.privateinternetaccess.com
Address: 108.61.122.114
Name:	france.privateinternetaccess.com
Address: 108.61.123.72
Name:	france.privateinternetaccess.com
Address: 108.61.122.225
Name:	france.privateinternetaccess.com
Address: 108.61.122.217

Similarly, the config file for Japan says it’s japan.privateinternetaccess.com, not jp.

MarchHare · 8 April 2018 14:05

I redownloaded the config files and changed everything to the way I did it on my pi (which was almost the same).

Instead of user.txt I used login.conf (was suggested somewhere) and it connects on both devices. My Pi was just on a name server that was down added googles dns as a test.

But

wget http://ipecho.net/plain -O - -q ; echo
gives me a correct IP now.

The problem now is that they constantly drop, it can take an hour or 1 second but the connection doesn’t persist for some reason.
they just always drop.

i set my static DNS to 209.222.18.222 and 209.222.18.218.
I dont know if it will help with stabilizing the connection but it’s worth to try.

it would be nice if it could automatically run on vero startup and keep the tunnel on or automatically reconnect if it drops.

dillthedog · 8 April 2018 16:27

I think the answer is that you can configure the system to run the Brian Hornsby add-on on startup:

github.com/brianhornsby/script.openvpn

Question: run at startup

opened 02:50PM - 03 Aug 14 UTC

closed 05:55PM - 06 Aug 14 UTC

bogdimon

Hi! ## Question Is it possible to run my PiA configured OpenVPN at boot atomati…cally? (It works when started manually from the GUI). Sorry for my (probably) stupid question, for I'm a linux\RaPi\programming noob. ## Why I need it I want to use bittorrent add-on in XBMC and would like my VPN to be up before any PtP activity ## My configuration - RaPi B+ - openelec 4.0.7 - OpenVPN script installed ### What I tried Writing following into autostart.sh: ``` #!/bin/sh RunScript(script.openvpn, PiA) & #Wait for the network to come up... while [ -z "$(connmanctl state 2>/dev/null | grep State | grep -E "ready|online")" ]; do sleep 0.25; done; logger -t "$(basename $0)" "** Network is up **" ``` (idea stolen from here http://forum.xbmc.org/showthread.php?tid=180764) ### Result However, nothing happened (checked by ifconfig). When trying to run that autostart.sh from ssh command line: ``` ./autostart.sh: line 2: syntax error: unexpected word (expecting ")") ``` Thank you a lot in advance! ## Update Following code in the autostart.sh seems to work when run manually from the command line, PiA1.ovpn being the config file created by your script. However, using this I don't have a nice option to check if the VPN is up using the GUI of the script :( It also somehow doesn't run automatically at startup. ``` #!/bin/sh openvpn /storage/.xbmc/userdata/addon_data/script.openvpn/PiA1.ovpn & # Wait for the network to come up... while [ -z "$(connmanctl state 2>/dev/null | grep State | grep -E "ready|online")" ]; do sleep 0.25; done; logger -t "$(basename $0)" "** Network is up **" ``` ## Update 2 Adding _sleep 8_ to the above code makes the whole thing work. So the autostart.sh _does run_ at startup, I presume the VPN-connection just has to take some time :) so, the **autostart.sh** could look like: ``` #!/bin/sh openvpn /storage/.xbmc/userdata/addon_data/script.openvpn/PiA1.ovpn & # Wait for the network to come up... sleep 20 ``` - I also wonder why the above loop, which should have waited for the VPN to be running doesn't work. However, I lack the knowledge to look into that. - The issue with having no GUI sign of the running VPN (apart from checking IP, say, from XBMC Hub Maintenance Tool) is still there.

but the add-on won’t automatically re-start openvpn if it stops/crashes. For that to happen you would need to run openvpn using systemd – and not use the add-on.

If you want to solve the dropping connection, we will need a log with a verbosity level of 3.

MarchHare · 8 April 2018 17:10

I thought systemd wasn’t an option with the latest version.

I could just as well set it up as systemd if someone could guide me through it, it’s an always on mediacenter so I wouldn’t mind for the vpn to just always be on by default, and since I’m doing the initial setup of everything now anyway be against it at all.

If the connection drops again i’ll post a verbose 3 log for now, it seems like I can’t connect with my pi anymore being unable to resolve the host through the DNS it used 10 minutes ago and the address it resolved at the moment so I wouldn’t call it stable.

dillthedog · 8 April 2018 18:10

Not that I’m aware of.

To run openvpn at startup:

To enable automatic restart:

MarchHare · 8 April 2018 18:28

thats so much easier! Why is everyone using the script! and no more openvpn error in the startup checklist, which I always thought was odd.

Going to try the automation thing and see how it goes but restarted and it went straight to connected.

Added the lines, no errors.

sudo wget http://ipecho.net/plain -O – -q ; echo
returns nothing just a empty space

curl ipinfo.io/ip
returns a vpn ip

Any other tests just to be sure?

My mistake sudo screws up wget http://ipecho.net/plain -O - -q ; echo

MarchHare · 10 April 2018 11:02

Tested a while now and it works like a charm, thank so you @dillthedog

Are there any iptables or such available to create an auto start killswitch/leak protection by any chance?

dillthedog · 10 April 2018 18:50

No, but you’ll find a whole bunch of articles using your favourite search engine. Just one example: