OpenVPN issue on OMV 1.9

  • Hi all,


    I just got a IPVanish VPN account (https://www.ipvanish.com) and I'm currently trying to set up the VPN connection.
    Thus I have installed the openmediavault-openvpn 1.1 pluging (not the openvpnas).
    Unfortunately, when I go in the certificat tab then try to add a user it return me the following error message:


    Failed to execute command 'export LANG=C; omv-mkconf openvpn add 6ccbc240-f81e-4cba-b31f-7d3a3588aaf0 2>&1': /usr/share/openmediavault/mkconf/openvpn: line 409: cd: /etc/openvpn/easy-rsa/2.0/: No such file or directory


    Erreur #4000:
    exception 'OMVException' with message 'Failed to execute command 'export LANG=C; omv-mkconf openvpn add 6ccbc240-f81e-4cba-b31f-7d3a3588aaf0 2>&1': /usr/share/openmediavault/mkconf/openvpn: line 409: cd: /etc/openvpn/easy-rsa/2.0/: No such file or directory' in /usr/share/openmediavault/engined/rpc/openvpn.inc:394
    Stack trace:
    #0 [internal function]: OMVRpcServiceOpenVpn->set(Array, Array)
    #1 /usr/share/php/openmediavault/rpcservice.inc(125): call_user_func_array(Array, Array)
    #2 /usr/share/php/openmediavault/rpc.inc(79): OMVRpcServiceAbstract->callMethod('set', Array, Array)
    #3 /usr/sbin/omv-engined(500): OMVRpc::exec('OpenVpn', 'set', Array, Array, 1)
    #4 {main}


    Neverthless, if I switch to parameter tab, then go back in the certificat tab, the new user is properly listed.


    However, after selecting the new user, I cannot download the certificat (nothing happen when I click on "Download certificat")


    => Could somebody help me setting up my VPN connection?

  • The openvpn plugin is a server not a client. Uninstall the openvpn plugin, and leave the openvpn binary package.


    apt-get remove openmediavault-openvpn


    place your ipvanish conf file at /etc/openvpn/ folder


    and start the service with


    /etc/init.d/openvpn start


    check route
    "ip r s"
    and interface
    "ifconfig tun0"

  • Hi,


    Thanks subzero79 for your quick feedback.
    I the meantime I also found a tuto on IPVanish web site (https://support.ipvanish.com/c…envpn-linux-command-line-).
    With all these data I was able to setup my VPN.
    Unfortunately, IPVanish VPN does not support port forwarding. Thus, once the VPN is activated on OMV, the server is no more accessible from the web, but only from my LAN.
    As I mostly control the server from outside my home, this is not acceptable for me. In addtition, if the VPN is activated I can no more use the FTP.
    The good point is that I did not paid for this VPN account (gift from my usenet provider).


    => For people who plan to set a VPN on there OMV server, take care to set a VPN that support port forwarding, otherwise you will only have acces to it from you LAN

  • Thus, once the VPN is activated on OMV, the server is no more accessible from the web, but only from my LAN.


    This is true because ipvanish (and any other provider) is gonna push redirect-gateway def1, you can already imagine what that does directive does, and if you don't know, go and read the openvpn documentation.


    Any request to ssh on the normal WAN gateway is gonna get replied through the tun interface. What you need is to establish rules to redirect packets that come from your home gateway to where they come from.


    For this you need iptables rules (with fwmark probably), a secondary route table, and add some route-up route-down scripts in openvpn configuration file.


    For help on this you can get much more information at #networking, #Netfilter and #openvpn channels at IRC freenode.


    Some time ago i purchased some ipvanish month for testing. My goal was to establish and exclusive vpn gateway for torrent application based on the daemon user (UID). Also if openvpn was down, no connection was allowed from the torrent application. The current iptables ruleset is uploaded to github as bash script. This might help you to get ideas

  • Sorry for the late reply this is a simple solution that @davidh2k mentioned here some time ago to solve this issue


    Code
    echo "1 admin" >> /etc/iproute2/rt_tables
    ip route add 192.168.178.0/24 dev eth0 src 192.168.178.58 table admin
    ip route add default via 192.168.178.1 dev eth0 table admin
    ip rule add from 192.168.178.58/32 table admin
    ip rule add to 192.168.178.58/32 table admin


    This solves the problem that i mentioned before, incoming traffic through eth0 gets replied through tun0, given the alteration to the route table, that your openvpn provider pushes to fwd all traffic through their gateway

  • @davr971 I am the owner of the openvpn plugin. The plugin currently doesn't offer a client config option. I am working on that for a future release. For VPN providers like ipvanish, I will have to test connectivity and see if I can split the routing table to accept the LAN and WAN connections. For now, go with @subzero79 suggestion.

  • Thanks @subzero79 and @shadowzero,
    These days I'm a little busy and do not have some much time to look at it.null


    Just for my understanding, the openmediavault-route plugin's goal is to set the iptable
    => Thus all the modification needed could be done through it, right ?


    Thanks for your support

  • Hi all,


    As I'm not an expert, I took time to have a look @subzero79 and @shadowzero sugestion.
    After some research about iptable I think I find someting that could help bypassing the VPN with few Iptables Rules.
    Actually I found 2 web sites which explain how to develop a script to set up the iptable properly at boot:
    http://www.linksysinfo.org/ind…hrough-vpn-openvpn.37240/
    https://forum.hidemyass.com/in…websites-and-more-tomato/


    Then I have set one script for my peronal need:


    However, before breaking all my network interfaces, I would appreciate if someone could have a look to this code.
    Actually, there are for me several open points:
    - In its previous comment @davidh2k talks about "table admin", but when looking on the web I mostly saw iptable with "table 100" (as in the above script) => Wath is the difference between these tables ?
    - In my understanding "nvram get wan_gateway" is a Tomato command that provides the gateway address, but is there an equivalent on OMV?


    Again, thanks for helping

  • @subzero79, my goal is to set all usenet and direct download into the VPN. And all other traffic outside of the VPN.
    In other words, I want only download traffic into the VPN. So I can still access to OMV, sonarr, couchpotato,... using my public I.

  • That's different from what you mentioned initially.
    The solution I presented was to solve the wrong route for incoming WAN requests in a simple way. In general this is out f the scope of OMV.


    What you want is called linux routing policy, as i mention before take a look at this for an example:


    https://github.com/subzero79/Openvpn-iptables


    That's routing done through process UID owner. If you need help in this again i recommend you the #netfilter and #openvpn channel.


    And also you're not going to break anything testing, the iptables rules are flushed away on reboot if you don't have iptables-persistent package installed

  • what are the "#netfilter and #openvpn channel"?


    Those are irc chat channels at freenode irc servers.


    Another option i analized back at the time are prebuilt docker container images that runs only sabnzbd+openvpn (or torrent_client+openvpn) which close the exit gateway if the vpn goes down.


    Like this one https://registry.hub.docker.com/u/binhex/arch-sabnzbdvpn/


    or this one https://registry.hub.docker.com/u/binhex/arch-delugevpn/


    I tested the deluge one once, and it worked correctly.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!