[SOLVED] OpenVPN - tap device does not come up

fukawi2 · 2012-08-30 08:54:36

I am trying to connect to an OpenVPN server. The server configuration is good; it works for Windows clients.

When I try to connect my Arch box, it says everything is good:

Aug 30 18:47:52 morpheus openvpn[7862]: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 30 18:47:52 morpheus openvpn[7862]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 30 18:47:52 morpheus openvpn[7862]: Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 30 18:47:52 morpheus openvpn[7862]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 30 18:47:52 morpheus openvpn[7862]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Aug 30 18:47:52 morpheus openvpn[7862]: [natoau] Peer Connection Initiated with 59.xxx.xxx.93:1115
Aug 30 18:47:54 morpheus openvpn[7862]: SENT CONTROL [natoau]: 'PUSH_REQUEST' (status=1)
Aug 30 18:47:54 morpheus openvpn[7862]: PUSH: Received control message: 'PUSH_REPLY,route 172.31.0.0 255.255.0.0 172.31.1.1,route-ipv6 2001:44b8:xxxxxx/56 2001:44b8:xxxxxxxxx::f0,route 192.168.0.0 255.255.254.0 172.31.1.1,ping 10,ping-restart 360'
Aug 30 18:47:54 morpheus openvpn[7862]: OPTIONS IMPORT: timers and/or timeouts modified
Aug 30 18:47:54 morpheus openvpn[7862]: OPTIONS IMPORT: route options modified
Aug 30 18:47:54 morpheus openvpn[7862]: ROUTE default_gateway=192.168.xxx.30
Aug 30 18:47:54 morpheus openvpn[7862]: TUN/TAP device tap0 opened
Aug 30 18:47:54 morpheus openvpn[7862]: TUN/TAP TX queue length set to 100
Aug 30 18:47:54 morpheus openvpn[7862]: /usr/sbin/ip route add 172.31.0.0/16 via 172.31.1.1
Aug 30 18:47:54 morpheus openvpn[7862]: ERROR: Linux route add command failed: external program exited with error status: 2
Aug 30 18:47:54 morpheus openvpn[7862]: /usr/sbin/ip route add 192.168.0.0/23 via 172.31.1.1
Aug 30 18:47:54 morpheus openvpn[7862]: ERROR: Linux route add command failed: external program exited with error status: 2
Aug 30 18:47:54 morpheus openvpn[7862]: Initialization Sequence Completed

The route errors are because the tap0 device doesn't actually come up; the "link" remains down, and no address is assigned:

 # ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 6c:f0:49:e8:64:28 brd ff:ff:ff:ff:ff:ff
    inet 192.168.x.x/27 brd 192.168.x.31 scope global eth0
    inet6 2001:44b8:4121:xxxxxxxxxxxxxxxxx/64 scope global dynamic 
       valid_lft 86396sec preferred_lft 14396sec
    inet6 fe80::6ef0:49ff:fee8:6428/64 scope link 
       valid_lft forever preferred_lft forever

Forcing the link up makes the device appear in the ip output, but still no address:

morpheus /etc/openvpn # ip link set tap0 up
morpheus /etc/openvpn # ip a s
....
11: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/ether 86:b9:40:dc:b6:da brd ff:ff:ff:ff:ff:ff
    inet6 fe80::84b9:40ff:fedc:b6da/64 scope link 
       valid_lft forever preferred_lft forever

I've also tried a netcfg profile for the same config; same result.

Any ideas why tap0 doesn't want to come up?

Last edited by fukawi2 (2012-09-04 05:12:36)

synthead · 2012-08-30 15:05:23

My guess would be to fix this:

ERROR: Linux route add command failed: external program exited with error status: 2

As a test, try removing the "route" commands in your OpenVPN config file and see if tap0 comes up (but without a route).

fukawi2 · 2012-09-04 05:12:23

FYI, I had to change my Windows config to up an --up script to explicitly request the DHCP address:

# this script brings the tap device up and starts a dhcpcd client on it
script-security 2
up /etc/openvpn/postup.sh
# we we wait until that's finished before adding routes...
route-delay 10

#!/bin/bash

tap_dev=$1
tap_mtu=$2
link_mtu=$3
ifconfig_local_ip=$4
ifconfig_netmask=$5

/usr/sbin/ip link set $tap_dev up
/usr/sbin/dhcpcd --background -L -t 10 --nogateway $tap_dev

exit 0

It's a bit (lot) of a hack, but it works. I have to start dhcpcd in the background otherwise OpenVPN seems to timeout the --up script and abort everything. I couldn't find how to extend the time limit that --up is allowed to run for.

This article helped point me in the right direction:
http://hans.fugal.net/blog/2009/01/06/p … its-place/

Arch Linux

#1 2012-08-30 08:54:36

[SOLVED] OpenVPN - tap device does not come up

#2 2012-08-30 15:05:23

Re: [SOLVED] OpenVPN - tap device does not come up

#3 2012-09-04 05:12:23

Re: [SOLVED] OpenVPN - tap device does not come up

Board footer