{"id":95,"date":"2012-11-22T16:50:56","date_gmt":"2012-11-23T00:50:56","guid":{"rendered":"http:\/\/blog.ls-al.com\/?p=95"},"modified":"2012-11-22T17:32:23","modified_gmt":"2012-11-23T01:32:23","slug":"openvpn-with-gnome-networkmanager-plug-in","status":"publish","type":"post","link":"https:\/\/blog.ls-al.com\/openvpn-with-gnome-networkmanager-plug-in\/","title":{"rendered":"OpenVPN with Gnome NetworkManager plug-in"},"content":{"rendered":"

Instructions how to use the OpenVPN plug-in with the Gnome NetworkManager.<\/p>\n

Details:<\/strong><\/p>\n

- In this case the OpenVPN server hands out dynamic IP addresses.
\n- Ubuntu 12.10 64-bit client.<\/p>\n

Get your user configuration file:<\/strong><\/p>\n

In a browser visit your OpenVPN server webpage at https:\/\/server.domain\/
\nFollow Login > Download \u201cYourself (user-locked profile)\u201d > Save As client.ovpn
\n** I renamed the file to client_29.ovpn since I have multiple servers I connect to.<\/em><\/p>\n

Split client.ovpn into several files:<\/strong><\/p>\n

The Gnome NetworkManager does not like using one big configuration file, although the command line OpenVPN client does work fine with one file (client.ovpn). \u00a0For NetworkManager you can break out manually with an editor or as follow. I used my personal home folder to store the files.<\/p>\n

\r\nsed -n '\/\/,\/<\\\/tls-auth>\/p' client_29.ovpn > sitename_ovpn_29tls.key\r\nsed -n '\/\/,\/<\\\/cert>\/p' client_29.ovpn > sitename_ovpn_29.crt\r\nsed -n '\/\/,\/<\\\/ca>\/p' client_29.ovpn > sitename_ovpn_29ca.cer\r\nsed -n '\/\/,\/<\\\/key>\/p' client_29.ovpn > sitename_ovpn_29.key\r\n<\/pre>\n
** After you split the configuration up remember to edit the files and remove the lines containing the open <> and close <\/> tags.<\/em><\/p>\n
Install the OpenVPN plugin for NetworkManager:<\/strong><\/p>\n
\r\n# aptitude install network-manager-openvpn-gnome\r\n<\/pre>\n
Below are some screen shots showing some configuration settings fro this particular setup. Your mileage may vary depending on how your administrator configured the server.<\/p>\n
\n
Add a new VPN Connection in GNOME:<\/p>\n
\"\"<\/a><\/p>\n
\n
Reference certificates and keys:<\/p>\n
\"\"<\/a><\/p>\n
\n
General Settings:<\/p>\n
\"\"<\/a><\/p>\n
\n
TLS Key:
\n\"\"<\/a><\/p>\n
Showing syslog while connecting (snipped):<\/strong><\/p>\n
\r\nNov 22 08:49:42 u12 NetworkManager[660]:  Starting VPN service 'openvpn'...\r\nNov 22 08:49:43 u12 nm-openvpn[4791]: Control Channel Authentication: using '\/home\/rrosso\/sitename_ovpn_29tls.key' as a OpenVPN static key file\r\nNov 22 08:49:43 u12 nm-openvpn[4791]: LZO compression initialized\r\nNov 22 08:49:47 u12 NetworkManager[660]:  IPv4 configuration:\r\nNov 22 08:49:47 u12 NetworkManager[660]:  Internal Gateway: 172.22.91.1\r\nNov 22 08:49:47 u12 NetworkManager[660]:  Internal Address: 172.22.91.253\r\nNov 22 08:49:47 u12 NetworkManager[660]:  Internal Prefix: 24\r\nNov 22 08:49:48 u12 NetworkManager[660]:  VPN connection 'sitename device 29' (IP Config Get) complete.\r\nNov 22 08:49:48 u12 NetworkManager[660]:  ((null)): writing resolv.conf to \/sbin\/resolvconf\r\nNov 22 08:49:49 u12 dbus[402]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)\r\nNov 22 08:49:52 u12 nm-openvpn[4791]: Initialization Sequence Completed\r\nNov 22 08:50:08 u12 ntpdate[4876]: step time server 91.189.94.4 offset 9.301349 sec\r\n<\/pre>\n
Older (pre Ubuntu 12.04) information. \u00a0May or may not be useful to you.<\/span><\/strong><\/p>\n
How to test a manual connection(no Network Manager plug-in):<\/strong><\/p>\n
\r\nrrosso@u10:~$ sudo openvpn --config client.ovpn --script-security 2\r\nSat Mar 19 10:14:34 2011 OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 12 2010\r\nEnter Auth Username:rrosso\r\nEnter Auth Password:\r\n...\r\n<\/pre>\n
Older versions of Ubuntu and NetworkManager this was a necessary addition to set DNS:<\/strong><\/p>\n
\r\nrrosso@u10:~$ tail -3 client.ovpn\r\n#rrosso added for DNS resolver\r\nup \/etc\/openvpn\/update-resolv-conf\r\ndown \/etc\/openvpn\/update-resolv-conf\r\n<\/pre>\n
Several problems I encountered with permissions on older versions:<\/strong>
\n- NetworkManager: <WARN> vpn_service_watch_cb()
\n- VPN service 'org.freedesktop.NetworkManager.openvpn' exited with error: 1
\n- connection_need_secrets_cb()<\/p>\n
https:\/\/bugs.launchpad.net\/ubuntu\/+source\/network-manager-openvpn\/+bug\/360818<\/p>\n
Debug NetworkManager as follow:<\/strong>
\nhttp:\/\/live.gnome.org\/NetworkManager\/Debugging<\/p>\n
\r\n# OPENVPN_DEBUG=1 \/usr\/lib\/network-manager-openvpn\/nm-openvpn-service\r\n<\/pre>\n
http:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=527975
\nhttps:\/\/bugs.launchpad.net\/ubuntu\/+source\/network-manager-vpnc\/+bug\/360818<\/p>\n
** Not sure if tinkering with this next file helped but changed it to look as follow and could at least troubleshoot further after wards.<\/em><\/p>\n
Permissions problem:<\/strong><\/p>\n
\r\n# cat \/etc\/dbus-1\/system.d\/nm-openvpn-service.conf\r\n<!DOCTYPE busconfig PUBLIC\r\n"-\/\/freedesktop\/\/DTD D-BUS Bus Configuration 1.0\/\/EN"\r\n"http:\/\/www.freedesktop.org\/standards\/dbus\/1.0\/busconfig.dtd">\r\n<busconfig>\r\n<policy user="root">\r\n<allow own="org.freedesktop.NetworkManager.openvpn"\/>\r\n<allow send_destination="org.freedesktop.NetworkManager.openvpn"\/>\r\n<\/policy>\r\n<\/busconfig>\r\n<\/pre>\n
** I restored the original file and things are still working<\/em><\/p>\n
Some older links on DNS resolver and OpenVPN:<\/strong>
\nhttp:\/\/www.subvs.co.uk\/openvpn_resolvconf
\nhttp:\/\/forums.openvpn.net\/topic7109.html<\/p>\n","protected":false},"excerpt":{"rendered":"
Instructions how to use the OpenVPN plug-in with the Gnome NetworkManager. Details: – In this case the OpenVPN server hands<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-95","post","type-post","status-publish","format-standard","hentry","category-vpn"],"_links":{"self":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/95","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/comments?post=95"}],"version-history":[{"count":0,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/95\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/media?parent=95"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/categories?post=95"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/tags?post=95"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}