Could not connect

[nathanoertel]

I've followed the steps to set everything up. I downloaded the profile that my OpenVPN Connect OSX application is using to connect to the VPN (saved as vpn_configs/dev.ovpn). I'm getting the error Could not connect when I try to run the following command:

docker run -v $(pwd)/vpn_configs/:/vpn_configs -it --cap-add NET_ADMIN -p 22222:22 --env DVPN_CONFIG=dev.ovpn docker-vpn

This is the output of that command:

.............................................................Could not connect
2021-11-12 18:27:32 OpenVPN 2.5.2 aarch64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May  4 2021
2021-11-12 18:27:32 library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021-11-12 18:28:11 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2021-11-12 18:28:11 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-11-12 18:28:11 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-11-12 18:28:11 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2021-11-12 18:28:11 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2021-11-12 18:28:11 TCP/UDP: Preserving recently used remote address: [AF_INET]<IP_ADDRESS>:1194
2021-11-12 18:28:11 Socket Buffers: R=[212992->212992] S=[212992->212992]
2021-11-12 18:28:11 UDP link local: (not bound)
2021-11-12 18:28:11 UDP link remote: [AF_INET]<IP_ADDRESS>:1194
2021-11-12 18:28:11 TLS: Initial packet from [AF_INET]<IP_ADDRESS>:1194, sid=ef5b5968 f8e0f2a6
2021-11-12 18:28:11 VERIFY OK: depth=1, CN=OpenVPN CA
2021-11-12 18:28:11 VERIFY KU OK
2021-11-12 18:28:11 Validating certificate extended key usage
2021-11-12 18:28:11 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-11-12 18:28:11 VERIFY EKU OK
2021-11-12 18:28:11 VERIFY OK: depth=0, CN=OpenVPN Server
2021-11-12 18:28:11 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2021-11-12 18:28:11 [OpenVPN Server] Peer Connection Initiated with [AF_INET]<IP_ADDRESS>:1194
2021-11-12 18:28:11 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,redirect-private def1,redirect-private bypass-dhcp,redirect-private autolocal,redirect-private bypass-dns,route-gateway 172.27.232.1,route 172.27.224.0 255.255.240.0,route 10.1.0.0 255.255.0.0,block-ipv6,ifconfig 172.27.232.27 255.255.252.0,peer-id 0,auth-tokenSESS_ID,cipher AES-256-GCM'
2021-11-12 18:28:11 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:4: dhcp-pre-release (2.5.2)
2021-11-12 18:28:11 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.5.2)
2021-11-12 18:28:11 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.5.2)
2021-11-12 18:28:11 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2021-11-12 18:28:11 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2021-11-12 18:28:11 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2021-11-12 18:28:11 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-11-12 18:28:11 OPTIONS IMPORT: timers and/or timeouts modified
2021-11-12 18:28:11 OPTIONS IMPORT: explicit notify parm(s) modified
2021-11-12 18:28:11 OPTIONS IMPORT: --ifconfig/up options modified
2021-11-12 18:28:11 OPTIONS IMPORT: route options modified
2021-11-12 18:28:11 OPTIONS IMPORT: route-related options modified
2021-11-12 18:28:11 OPTIONS IMPORT: peer-id set
2021-11-12 18:28:11 OPTIONS IMPORT: adjusting link_mtu to 1624
2021-11-12 18:28:11 OPTIONS IMPORT: data channel crypto options modified
2021-11-12 18:28:11 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-11-12 18:28:11 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-11-12 18:28:11 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-11-12 18:28:11 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:02
2021-11-12 18:28:11 TUN/TAP device tun0 opened
2021-11-12 18:28:11 /sbin/ip link set dev tun0 up mtu 1500
2021-11-12 18:28:11 /sbin/ip link set dev tun0 up
2021-11-12 18:28:11 /sbin/ip addr add dev tun0 172.27.232.27/22
2021-11-12 18:28:11 /etc/openvpn/up.sh tun0 1500 1552 172.27.232.27 255.255.252.0 init
2021-11-12 18:28:16 ROUTE remote_host is NOT LOCAL
2021-11-12 18:28:16 /sbin/ip route add <IP_ADDRESS>/32 via 172.17.0.1
2021-11-12 18:28:16 /sbin/ip route add 172.27.224.0/20 metric 101 via 172.27.232.1
2021-11-12 18:28:16 /sbin/ip route add 10.1.0.0/16 metric 101 via 172.27.232.1
2021-11-12 18:28:16 Initialization Sequence Completed

When I view the active connections on the VPN server it shows an active connection while that is setting up. Is there any obvious error that could be causing this or any tips on debugging it?

[br0ziliy]

I pushed c9e2e93 to master, please try now.
It will either fix your issue, or provide a bit more details to help us debug further.

[DeflateAwning]

I'm having this same issue. I can't get it to connect.

docker run -v C:\Users\.../vpn_configs/:/vpn_configs -it --cap-add NET_ADMIN -p 22222:22 --env DVPN_CONFIG=vpn-config.ovpn docker-vpn

OpenVPN config in use: vpn-config.ovpn

.............................................................Could not connect - timeout
2023-03-22 17:45:50 OpenVPN 2.5.8 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Nov  2 2022
2023-03-22 17:45:50 library versions: OpenSSL 3.0.8 7 Feb 2023, LZO 2.10
2023-03-22 17:45:50 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-03-22 17:45:50 TCP/UDP: Preserving recently used remote address: [AF_INET]34.202.211.119:443
2023-03-22 17:45:50 Socket Buffers: R=[131072->131072] S=[16384->16384]
2023-03-22 17:45:50 Attempting to establish TCP connection with [AF_INET]34.202.211.119:443 [nonblock]
2023-03-22 17:45:50 TCP connection established with [AF_INET]34.202.211.119:443
2023-03-22 17:45:50 TCP_CLIENT link local: (not bound)
2023-03-22 17:45:50 TCP_CLIENT link remote: [AF_INET]34.202.211.119:443
2023-03-22 17:45:50 TLS: Initial packet from [AF_INET]34.202.211.119:443, sid=f5503357 b6adfcb0
2023-03-22 17:45:50 VERIFY OK: depth=1, CN=REDACTED
2023-03-22 17:45:50 VERIFY KU OK
2023-03-22 17:45:50 Validating certificate extended key usage
2023-03-22 17:45:50 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-03-22 17:45:50 VERIFY EKU OK
2023-03-22 17:45:50 VERIFY OK: depth=0, CN=REDACTED
2023-03-22 17:45:50 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2023-03-22 17:45:50 [REDACTED] Peer Connection Initiated with [AF_INET]34.202.211.119:443
2023-03-22 17:45:52 SENT CONTROL [REDACTED]: 'PUSH_REQUEST' (status=1)
2023-03-22 17:45:52 PUSH: Received control message: 'PUSH_REPLY,route 172.31.0.0 255.255.0.0,route-gateway 10.1.1.33,topology subnet,ping 1,ping-restart 20,ifconfig 10.1.1.34 255.255.255.224,peer-id 0,cipher AES-256-GCM'
2023-03-22 17:45:52 OPTIONS IMPORT: timers and/or timeouts modified
2023-03-22 17:45:52 OPTIONS IMPORT: --ifconfig/up options modified
2023-03-22 17:45:52 OPTIONS IMPORT: route options modified
2023-03-22 17:45:52 OPTIONS IMPORT: route-related options modified
2023-03-22 17:45:52 OPTIONS IMPORT: peer-id set
2023-03-22 17:45:52 OPTIONS IMPORT: adjusting link_mtu to 1626
2023-03-22 17:45:52 OPTIONS IMPORT: data channel crypto options modified
2023-03-22 17:45:52 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2023-03-22 17:45:52 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2023-03-22 17:45:52 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:02
2023-03-22 17:45:52 TUN/TAP device tun0 opened
2023-03-22 17:45:52 /sbin/ip link set dev tun0 up mtu 1500
2023-03-22 17:45:52 /sbin/ip link set dev tun0 up
2023-03-22 17:45:52 /sbin/ip addr add dev tun0 10.1.1.34/27
2023-03-22 17:45:52 /etc/openvpn/up.sh tun0 1500 1626 10.1.1.34 255.255.255.224 init
2023-03-22 17:45:52 /sbin/ip route add 172.31.0.0/16 via 10.1.1.33
2023-03-22 17:45:52 Initialization Sequence Completed

[br0ziliy]

@DeflateAwning Your OpenVPN output looks good, it's connecting; the container stops because for some reason ip r get 1.2.3.4 command does not report that a tunnel was created. I've just checked and all is working fine for me on a Mac...

If you'd like to help me debug it, could you please do the following:

• run the container as following: docker run -v C:\Users\.../vpn_configs/:/vpn_configs -it --cap-add NET_ADMIN -p 22222:22 --env DVPN_CONFIG=vpn-config.ovpn --env DVPN_DEBUG=1 docker-vpn - this will give you a shell inside the container
• while in the shell, initiate the connection manually: /usr/sbin/openvpn --config /vpn_configs/vpn-config.ovpn --log /var/log/openvpn.log --script-security 2 --up /etc/openvpn/up.sh --down /etc/openvpn/down.sh - this will exit immediately; run this command until you see Initialization Sequence Completed as last line (indicates successful connection): cat /var/log/openvpn.log
• run following commands and provide me the output here: ps axfuww | grep bin/[o]penvpn; ip r get 1.2.3.4

[DeflateAwning]

The second command (/usr/sbin/openvpn ...) never completes, and shows no output. Instead, I ran it in the background by appending an ampersand after the command.

cat /var/log/openvpn.log shows the same output as earlier.

Debug command output, with newlines between the two commands:

[debugging mode] / # ps axfuww | grep bin/[o]penvpn; echo ; echo ; echo ; ip r get 1.2.3.4
   13 root      0:00 /usr/sbin/openvpn --config /vpn_configs/vpn-config.ovpn --log /var/log/openvpn.log --script-security 2 --up /etc/openvpn/up.sh --down /etc/openvpn/down.sh



1.2.3.4 via 172.17.0.1 dev eth0 src 172.17.0.2 uid 0
    cache
[debugging mode] / #