OpenVPN: unable to connect over GUI

manni_watzki · July 4, 2016, 1:04pm

Hi everybody!
I’ve struggled for a couple of months, since I changed VPN provider, against a connection that won’t work.

Everytime I have to deal with the same frustration: connection terminated after less than a minute, every Internet resource unavailable during that time. I have tried everything, both importing .ovpn file and manually entering all parameters when creating connection. That though I strictly follow instructions.

Here is an example of config file:

remote de1.ibvpn.com 1194 tcp
remote 178.162.197.145 1194 tcp
auth-user-pass user_pass.txt
up 'update-resolv-conf'
down 'update-resolv-conf'
link-mtu 1578
dev tap
server-poll-timeout 20
client
nobind
resolv-retry infinite
auth-retry nointeract
persist-key
persist-tun
mute-replay-warnings
comp-lzo
verb 3
mute 20
ns-cert-type server
route-method exe
route-delay 2
script-security 3 system
reneg-sec 0
<ca>
-----BEGIN CERTIFICATE-----
…]
-----END CERTIFICATE-----
</ca>

Here’s what I get from system log:

# journalctl --since=2016-06-26 -u NetworkManager
Jun 26 23:34:04 Asus-X52F NetworkManager[1014]: <info>  Starting VPN service 'openvpn'...
Jun 26 23:34:04 Asus-X52F NetworkManager[1014]: <info>  VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 6916
Jun 26 23:34:04 Asus-X52F NetworkManager[1014]: <info>  VPN service 'openvpn' appeared; activating connections
Jun 26 23:34:04 Asus-X52F NetworkManager[1014]: (nm-openvpn-service:6916): nm-openvpn-WARNING **: Directory '/var/lib/openvpn/chroot' not usable for chroot by 'nm-openvpn', openvpn will not be chrooted.
Jun 26 23:34:04 Asus-X52F NetworkManager[1014]: <info>  VPN plugin state changed: starting (3)
Jun 26 23:34:04 Asus-X52F NetworkManager[1014]: nm-openvpn-Message: openvpn started with pid 6920
Jun 26 23:34:04 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_(Frankfurt_1)' (Connect) reply received.
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: OpenVPN 2.3.10 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan  4 2016
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: library versions: OpenSSL 1.0.1i-fips 6 Aug 2014, LZO 2.08
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: UDPv4 link local: [undef]
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: UDPv4 link remote: [AF_INET]178.162.221.62:1194
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap'
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1578'
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'
Jun 26 23:34:04 Asus-X52F nm-openvpn[6920]: [server] Peer Connection Initiated with [AF_INET]178.162.221.62:1194
Jun 26 23:34:07 Asus-X52F nm-openvpn[6920]: Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: show-net-up (2.3.10)
Jun 26 23:34:07 Asus-X52F nm-openvpn[6920]: WARNING: Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address.  You are using something (255.255.255.0) that looks more like a n
Jun 26 23:34:07 Asus-X52F nm-openvpn[6920]: TUN/TAP device tun0 opened
Jun 26 23:34:07 Asus-X52F nm-openvpn[6920]: /usr/lib/nm-openvpn-service-openvpn-helper --tun -- tun0 1500 1542 10.10.10.2 255.255.255.0 init
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  (tun0): new Tun device (carrier: OFF, driver: 'tun', ifindex: 4)
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_(Frankfurt_1)' (IP Config Get) reply received.
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_(Frankfurt_1)' (IP4 Config Get) reply received.
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  VPN Gateway: 178.162.221.62
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  Tunnel Device: tun0
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  IPv4 configuration:
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    Internal Gateway: 10.10.10.1
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    Internal Address: 10.10.10.2
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    Internal Prefix: 24
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    Internal Point-to-Point Address: 0.0.0.0
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    Maximum Segment Size (MSS): 0
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    Forbid Default Route: no
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    Internal DNS: 1.2.3.4
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>    DNS Domain: '(none)'
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  No IPv6 configuration
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  VPN plugin state changed: started (4)
Jun 26 23:34:07 Asus-X52F nm-openvpn[6920]: GID set to nm-openvpn
Jun 26 23:34:07 Asus-X52F nm-openvpn[6920]: UID set to nm-openvpn
Jun 26 23:34:07 Asus-X52F nm-openvpn[6920]: Initialization Sequence Completed
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_(Frankfurt_1)' (IP Config Get) complete.
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  (tun0): link connected
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_LOCAL
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_GLOBAL
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  keyfile: add connection in-memory (edd2cd03-18da-40fa-85a2-ab3c6ec5733c,"tun0")
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: unmanaged -> unavailable (reason 'connection-assumed') [10 20 41]
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: unavailable -> disconnected (reason 'connection-assumed') [20 30 41]
Jun 26 23:34:07 Asus-X52F NetworkManager[1014]: <info>  (tun0): Activation: starting connection 'tun0' (edd2cd03-18da-40fa-85a2-ab3c6ec5733c)
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: disconnected -> prepare (reason 'none') [30 40 0]
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: prepare -> config (reason 'none') [40 50 0]
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: config -> ip-config (reason 'none') [50 70 0]
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: ip-config -> ip-check (reason 'none') [70 80 0]
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: ip-check -> secondaries (reason 'none') [80 90 0]
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  (tun0): device state change: secondaries -> activated (reason 'none') [90 100 0]
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_LOCAL
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_GLOBAL
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  Policy set 'tun0' (tun0) as default for IPv4 routing and DNS.
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jun 26 23:34:08 Asus-X52F NetworkManager[1014]: <info>  (tun0): Activation: successful, device activated.
Jun 26 23:34:17 Asus-X52F nm-openvpn[6920]: Bad LZO decompression header byte: 0
Jun 26 23:34:28 Asus-X52F nm-openvpn[6920]: Bad LZO decompression header byte: 0
Jun 26 23:34:38 Asus-X52F nm-openvpn[6920]: Bad LZO decompression header byte: 0
Jun 26 23:34:48 Asus-X52F nm-openvpn[6920]: Bad LZO decompression header byte: 0
Jun 26 23:34:58 Asus-X52F nm-openvpn[6920]: Bad LZO decompression header byte: 0
Jun 26 23:35:07 Asus-X52F nm-openvpn[6920]: [server] Inactivity timeout (--ping-restart), restarting
Jun 26 23:35:07 Asus-X52F nm-openvpn[6920]: SIGUSR1[soft,ping-restart] received, process restarting
Jun 26 23:35:09 Asus-X52F nm-openvpn[6920]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jun 26 23:35:09 Asus-X52F nm-openvpn[6920]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

Customer care assured me, everything is OK. That’s really weird, it all works via command line.
Who has any clue, what’s wrong here? Is it really an old, not yet fixed bug?
Everything, included KDE (5.6.90), is up to date. I also unsuccessfully tried to remove, then reinstall, any regarding package.
Thanks in advance for every helpful answer.

tsu2 · July 4, 2016, 4:04pm

It’s hard to say, but I <think> the logs are saying that when you use Netmanager, there’s something wrong with the configured nameserver.

Did you sanitize the address, or is your VPN nameserver really 1.2.3.4?

TSU

manni_watzki · July 4, 2016, 5:05pm

I don’t have any clue, just imported configuration file. OS version is wrong, anyway, I thought I selected Leap 42.1.

deano_ferrari · July 5, 2016, 1:20pm

Well, it’s likely that the server configuration has keepalive employed with something like

keepalive 10 60

which means the server will send pin-like messages to the client every 10s and re-initialize the connection if no response is received after a minute. However, it’s not clear to me why this may be occurring.

deano_ferrari · July 5, 2016, 1:22pm

I’ve corrected the version prefix for you.

arvidjaar · July 5, 2016, 1:42pm

Apparently your peer does not use compression. You could start with not requesting it in your configuration. And fixing all those warnings about configuration mismatch as well.

manni_watzki · July 5, 2016, 2:39pm

Compression is requested. Deselecting it causes me the same errors.

Anyway, config file edited:

…]
link-mtu 1578
tun-mtu 1532
mtu-dynamic
…]

It didn’t help me fix my issue. VPN connection is still not working, when established over KDE. Editing did not even fix the mismatch, even if I import the new config again.

Jul 05 14:25:08 Asus-X52F NetworkManager[1014]: <info>  Starting VPN service 'openvpn'...
Jul 05 14:25:08 Asus-X52F NetworkManager[1014]: <info>  VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 8134
Jul 05 14:25:08 Asus-X52F NetworkManager[1014]: <info>  VPN service 'openvpn' appeared; activating connections
Jul 05 14:25:19 Asus-X52F NetworkManager[1014]: <info>  VPN plugin state changed: starting (3)
Jul 05 14:25:19 Asus-X52F NetworkManager[1014]: (nm-openvpn-service:8134): nm-openvpn-WARNING **: Directory '/var/lib/openvpn/chroot' not usable for chroot by 'nm-openvpn', openvpn will not be chrooted.
Jul 05 14:25:19 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_Frankfurt_1' (Connect) reply received.
Jul 05 14:25:19 Asus-X52F NetworkManager[1014]: nm-openvpn-Message: openvpn started with pid 8137
Jul 05 14:25:19 Asus-X52F nm-openvpn[8137]: **OpenVPN 2.3.8 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Aug  4 2015**
Jul 05 14:25:19 Asus-X52F nm-openvpn[8137]: **library versions: OpenSSL 1.0.1i-fips 6 Aug 2014, LZO 2.08**
Jul 05 14:25:19 Asus-X52F nm-openvpn[8137]: **WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.**
Jul 05 14:25:19 Asus-X52F nm-openvpn[8137]: **NOTE: the current --script-security setting may allow this configuration to call user-defined scripts**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1532)**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **UDPv4 link local: [undef]**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **UDPv4 link remote: [AF_INET]178.162.197.145:1194**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap'**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1574', remote='link-mtu 1578'**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **[server] Peer Connection Initiated with [AF_INET]178.162.197.145:1194**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
Jul 05 14:25:20 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
Jul 05 14:25:21 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
Jul 05 14:25:21 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
Jul 05 14:25:21 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: show-net-up (2.3.8)**
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **WARNING: Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address.  You are using something (255.255.255.0) that looks more like a n**
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **TUN/TAP device tun5 opened**
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **/usr/lib/nm-openvpn-service-openvpn-helper --tun -- tun5 1532 1574 10.10.10.12 255.255.255.0 init**
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): new Tun device (carrier: OFF, driver: 'tun', ifindex: 15)
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_Frankfurt_1' (IP Config Get) reply received.
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_Frankfurt_1' (IP4 Config Get) reply received.
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  VPN Gateway: 178.162.197.145
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  Tunnel Device: tun5
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  IPv4 configuration:
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    Internal Gateway: 10.10.10.1
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    Internal Address: 10.10.10.12
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    Internal Prefix: 24
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    Internal Point-to-Point Address: 0.0.0.0
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    Maximum Segment Size (MSS): 0
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    Forbid Default Route: no
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    Internal DNS: 1.2.3.4
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>    DNS Domain: '(none)'
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  No IPv6 configuration
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  VPN plugin state changed: started (4)
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **GID set to nm-openvpn**
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **UID set to nm-openvpn**
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **Initialization Sequence Completed**
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  VPN connection 'ibVPN_Germany_Frankfurt_1' (IP Config Get) complete.
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): link connected
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_LOCAL
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_GLOBAL
Jul 05 14:25:22 Asus-X52F dns-resolver[8188]: **You can find my version in /etc/resolv.conf.netconfig**
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jul 05 14:25:22 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  keyfile: add connection in-memory (68ec64a1-97da-4886-9651-4a2c7586eb02,"tun5")
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: unmanaged -> unavailable (reason 'connection-assumed') [10 20 41]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: unavailable -> disconnected (reason 'connection-assumed') [20 30 41]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): Activation: starting connection 'tun5' (68ec64a1-97da-4886-9651-4a2c7586eb02)
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: disconnected -> prepare (reason 'none') [30 40 0]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: prepare -> config (reason 'none') [40 50 0]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: config -> ip-config (reason 'none') [50 70 0]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: ip-config -> ip-check (reason 'none') [70 80 0]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: ip-check -> secondaries (reason 'none') [80 90 0]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: secondaries -> activated (reason 'none') [90 100 0]
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_LOCAL
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_GLOBAL
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  Policy set 'tun5' (tun5) as default for IPv4 routing and DNS.
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jul 05 14:25:22 Asus-X52F NetworkManager[1014]: <info>  (tun5): Activation: successful, device activated.

manni_watzki · July 5, 2016, 2:41pm

Jul 05 14:25:23 Asus-X52F nm-openvpn[8137]: **Bad LZO decompression header byte: 0**
…]
Jul 05 14:26:22 Asus-X52F nm-openvpn[8137]: **[server] Inactivity timeout (--ping-restart), restarting**
Jul 05 14:26:22 Asus-X52F nm-openvpn[8137]: **SIGUSR1[soft,ping-restart] received, process restarting**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **NOTE: the current --script-security setting may allow this configuration to call user-defined scripts**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1532)**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **UDPv4 link local: [undef]**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **UDPv4 link remote: [AF_INET]178.162.197.145:1194**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap'**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1574', remote='link-mtu 1578'**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'**
Jul 05 14:26:24 Asus-X52F nm-openvpn[8137]: **[server] Peer Connection Initiated with [AF_INET]178.162.197.145:1194**
Jul 05 14:26:26 Asus-X52F nm-openvpn[8137]: **AUTH: Received control message: AUTH_FAILED**
Jul 05 14:26:26 Asus-X52F nm-openvpn[8137]: **SIGUSR1[soft,auth-failure] received, process restarting**
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: **<warn>  VPN plugin failed: login-failed (0)**
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: <info>  VPN plugin state changed: stopped (6)
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: <info>  VPN plugin state change reason: login-failed (10)
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: (nm-openvpn-service:8134): nm-openvpn-WARNING **: Password verification failed
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jul 05 14:26:26 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: **<warn>  error disconnecting VPN: Could not process the request because no VPN connection was active.**
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_LOCAL
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: <info>  NetworkManager state is now CONNECTED_GLOBAL
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: <info>  Policy set 'Ethernet' (eth0) as default for IPv4 routing and DNS.
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jul 05 14:26:27 Asus-X52F NetworkManager[1014]: <info>  (tun5): link disconnected (deferring action for 4 seconds)
Jul 05 14:26:31 Asus-X52F NetworkManager[1014]: <info>  (tun5): link disconnected (calling deferred action)
Jul 05 14:26:31 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: activated -> unavailable (reason 'carrier-changed') [100 20 40]
Jul 05 14:26:32 Asus-X52F NetworkManager[1014]: dns-resolver: ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched...
Jul 05 14:26:32 Asus-X52F NetworkManager[1014]: dns-resolver: You can find my version in /etc/resolv.conf.netconfig
Jul 05 14:26:32 Asus-X52F NetworkManager[1014]: ATTENTION: You have modified /etc/resolv.conf.  Leaving it untouched...
Jul 05 14:26:32 Asus-X52F NetworkManager[1014]: You can find my version in /etc/resolv.conf.netconfig ...
Jul 05 14:26:32 Asus-X52F NetworkManager[1014]: <info>  (tun5): device state change: unavailable -> unmanaged (reason 'none') [20 10 0]

arvidjaar · July 5, 2016, 5:40pm

Can you establish connection using openVPN directly, without using NetworkManager? It is quite possible that NM does not use your config file at all.

manni_watzki · July 5, 2016, 6:44pm

What do you mean?
Via CLI it does work flawlessly.
I didn’t have such issues with my former VPN provider, just random, spontaneous disconnections, solved through port forwarding and appropriate firewall settings.

arvidjaar · July 6, 2016, 12:27pm

I assume when you call openvpn.

NetworkManager plugin does not use stored configuration file, it calls openvpn binary with a lot of command line options. Could you post how this invocation looks like (use “ps -efwww” to not truncate long lines)? Also could you attempt the same openvpn invocation manually, outside of NM - do you observe the same problem?

manni_watzki · July 6, 2016, 6:02pm

…]**/etc/openvpn #** openvpn --config ibVPN_Germany_Frankfurt_2.ovpn

**#** ps -efwww | grep openvpn

root      5571  2244  0 17:26 pts/3    00:00:00 **openvpn** --config ibVPN_Germany_Frankfurt_2.ovpn

If I close connection and start it over KDE, I get this:

**#** ps -efwww | grep openvpn

root      8493     1  0 17:51 ?        00:00:00 /usr/lib/nm-**openvpn**-service

nm-open+  8504  8493  0 17:51 ?        00:00:00 /usr/sbin/**openvpn** --remote 46.165.236.109 1194 udp --comp-lzo --nobind --dev tun --auth-nocache --reneg-sec 0 --syslog nm-**openvpn** --script-security 2 --up /usr/lib/nm-**openvpn**-service-**openvp****n**-helper --tun -- --up-restart --persist-key --persist-tun --management /var/run/NetworkManager/nm-**openvpn**-6061dc45-1261-4381-b71e-6129e333ec35 unix --management-client-user root --management-client-group root --management-query-passwords --auth-retry interact --route-noexec --ifconfig-noexec --client --auth-user-pass --ca /home/$USER]/.local/share/networkmanagement/certificates/ibVPN_Germany_Frankfurt_2/ca.crt --user nm-**openvpn** --group nm-**openvpn**

Processes remain active even if I disconnect.

Furthermore, something weird caught my attention when I started connection over terminal, and it’s these (bold, underlined) output lines:


…
Wed Jul  6 17:48:53 2016 update-resolv-conf tap0 1502 1578 10.10.20.2 255.255.255.0 init
which: no resolvconf in ((null))
dhcp-option DNS 1.2.3.4
**update-resolv-conf: line 56: -x: command not found**
Wed Jul  6 17:48:55 2016 /bin/ip route add 46.165.236.109/32 via 192.168.1.1
Wed Jul  6 17:48:55 2016 /bin/ip route add 0.0.0.0/1 via 10.10.20.1
Wed Jul  6 17:48:55 2016 /bin/ip route add 128.0.0.0/1 via 10.10.20.1
Wed Jul  6 17:48:55 2016 Initialization Sequence Completed
^CWed Jul  6 17:50:52 2016 event_wait : Interrupted system call (code=4)
Wed Jul  6 17:50:52 2016 /bin/ip route del 46.165.236.109/32
Wed Jul  6 17:50:52 2016 /bin/ip route del 0.0.0.0/1
Wed Jul  6 17:50:52 2016 /bin/ip route del 128.0.0.0/1
Wed Jul  6 17:50:52 2016 Closing TUN/TAP interface
Wed Jul  6 17:50:52 2016 /bin/ip addr del dev tap0 10.10.20.2/24
Wed Jul  6 17:50:52 2016 update-resolv-conf tap0 1502 1578 10.10.20.2 255.255.255.0 init
which: no resolvconf in ((null))
**update-resolv-conf: line 59: -d: command not found**

gogalthorp · July 6, 2016, 6:20pm

Are you trying to run as root???

manni_watzki · July 6, 2016, 7:10pm

Per terminal I can connect to VPN only as root, otherwise I get access denied. But that’s not important, anyway.

arvidjaar · July 6, 2016, 8:56pm

Did not you say that you disabled compression? Apparently not, it is still present.

manni_watzki · July 6, 2016, 9:07pm

No need to answer, an answer is already present and clear in the previous page.

manni_watzki · July 14, 2016, 8:19pm

O.K., I tried to reproduce the error using a virtual machine. I get the same issue even with a fresh installation, even with a different desktop environment (Gnome instead of KDE).
If it’s not a bug, then it could be a configuration error on the part of VPN provider.
How can I report this bug?

manni_watzki · July 16, 2016, 4:31pm

I tested the connection under Fedora, without getting any error or spontaneous disconnection. Every resource was available.
I guess nm-openvpn doesn’t work right under openSUSE itself.
Therefore I’m going to report this bug.

manni_watzki · October 1, 2016, 4:46pm

After several months waiting for a solution as well as a bug report, I notice with much satisfaction it’s finally been corrected. Tested with KDE 5.7.5.

Therefore I accord to closing this thread.