sudo openvpn --config [VPN-NAME].ovpn
:有效
NetworkManager 配置:不起作用(雖然相同,但複製貼上配置)
[VPN-NAME].ovpn
:
dev tun
persist-tun
persist-key
ncp-disable
cipher AES-256-CBC
auth SHA512
tls-client
client
resolv-retry infinite
remote [hostname] 1194 udp
setenv opt block-outside-dns
lport 0
verify-x509-name "[hostname]" name
auth-user-pass
remote-cert-tls server
<ca>
[CA CERTIFICATE]
</ca>
<cert>
[CERT CERTIFICATE]
</cert>
<key>
[CERT KEY]
</key>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
[TLS-KEY]
</tls-auth>
網路管理器配置:
- 將憑證和金鑰複製貼上
.ovpn
到離散文件中 - 選擇“連線類型”,值“帶有憑證的密碼 (TLS)”
- 複製貼上網關和檔案路徑
- 轉到“高級...”
- 在“TLS 設定”標籤中複製貼上 [VPN-NAME] 並選擇“準確驗證名稱”
- 選擇模式“TLS-Auth”,複製貼上
tls-auth.key
路徑,金鑰方向“Client (1)”
tail -f /var/log/syslog
:
debian NetworkManager[648]: <info> [1609951704.7482] audit: op="statistics" arg="refresh-rate-ms" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info> [1609951706.1485] audit: op="connection-activate" uuid="1afd25e7-f3cd-472d-9a3b-31f1ad390479" name="VPN-NAME" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info> [1609951706.1505] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: Started the VPN service, PID 6763
debian NetworkManager[648]: <info> [1609951706.1554] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: Saw the service appear; activating connection
debian NetworkManager[648]: <info> [1609951706.1591] audit: op="statistics" arg="refresh-rate-ms" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info> [1609951706.2483] audit: op="statistics" arg="refresh-rate-ms" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info> [1609951711.8373] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: state changed: starting (3)
debian nm-openvpn[6766]: OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
debian nm-openvpn[6766]: library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
debian nm-openvpn[6766]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
debian nm-openvpn[6766]: TCP/UDP: Preserving recently used remote address: [AF_INET]A.B.C.D:1194
debian nm-openvpn[6766]: UDP link local: (not bound)
debian nm-openvpn[6766]: UDP link remote: [AF_INET]A.B.C.D:1194
debian nm-openvpn[6766]: NOTE: chroot will be delayed because of --client, --pull, or --up-delay
debian nm-openvpn[6766]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
debian NetworkManager[648]: <warn> [1609951772.4259] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN connection: connect timeout exceeded.
debian nm-openvpn-serv[6763]: Connect timer expired, disconnecting.
debian NetworkManager[648]: <warn> [1609951772.4316] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: failed: connect-failed (1)
debian nm-openvpn[6766]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
debian NetworkManager[648]: <info> [1609951772.4317] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: state changed: stopping (5)
debian nm-openvpn[6766]: TLS Error: TLS handshake failed
debian NetworkManager[648]: <info> [1609951772.4317] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: state changed: stopped (6)
debian nm-openvpn[6766]: SIGTERM[hard,tls-error] received, process exiting
作業系統環境:
Debian 10 (buster)
核心Linux debian 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64 GNU/Linux
網路管理器:network-manager/stable,now 1.14.6-2+deb10u1 amd64
OpenVPN 外掛程式:network-manager-openvpn/stable,now 1.8.10-1 amd64
OpenVPN 獨立用戶端(openvpn
指令):
OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
從syslog
看來,網路管理器的 OpenVPN 外掛程式要麼使用已安裝的底層openvpn
,要麼具有安裝插件本身帶來的獨立客戶端,該客戶端具有相同的特性/功能,甚至具有獨立的版本openvpn
。
然後,它不起作用(但僅從網路管理器,獨立可以)...
答案1
network-manager-openvpn(可能還有 network-manager-openvpn-gnome)軟體包無法儲存 tls-auth 欄位。我正在使用 Ubuntu 22.04.3 LTS 和 network-manager-openvpn 1.8.18-1。我導入了 OpenVPN 設定文件,除了與 tls-auth 相關的欄位外,所有欄位均已正確填寫。即使在編輯這些欄位後,這些值也不會被儲存。但是,我可以使用 nmcli 編輯 VPN 連接,將“ta”(TLS-Auth 密鑰檔案)和“ta-dir”(密鑰方向)的值新增至 vpn.data。然後,網路管理器成功連線。配置對話框甚至顯示正確的值;它似乎無法拯救他們。
我不確定錯誤的狀態。以下錯誤報告聲稱該問題已於 2018 年在 NetworkManager-openvpn-1.8.8-1.fc29 中修復:https://bugzilla.redhat.com/show_bug.cgi?id=1639811
這是一個更新的錯誤報告,描述了我在幾乎相同的軟體包版本中看到的情況:https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/105