☰

OpenVPN 配置在 CLI 下有效，但在 NetworkManager 上无效（TLS 握手失败）

tag-icon • tag-icon debian openvpn networkmanager debian-buster
OpenVPN 配置在 CLI 下有效，但在 NetworkManager 上无效（TLS 握手失败）

sudo openvpn --config [VPN-NAME].ovpn：有效
NetworkManager 配置：无效（虽然相同，但复制粘贴了配置）

[VPN-NAME].ovpn：

dev tun
persist-tun
persist-key
ncp-disable
cipher AES-256-CBC
auth SHA512
tls-client
client
resolv-retry infinite
remote [hostname] 1194 udp
setenv opt block-outside-dns
lport 0
verify-x509-name "[hostname]" name
auth-user-pass
remote-cert-tls server
<ca>
[CA CERTIFICATE]
</ca>
<cert>
[CERT CERTIFICATE]
</cert>
<key>
[CERT KEY]
</key>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
[TLS-KEY]
</tls-auth>

网络管理器配置：

  • 将证书和密钥复制粘贴.ovpn到离散文件中
  • 选择“连接类型”，值“带证书的密码（TLS）”
  • 复制粘贴网关和文件路径
  • 进入“高级……”
  • 在“TLS 设置”选项卡中复制粘贴 [VPN-NAME] 并选择“精确验证名称”
  • 选择模式“TLS-Auth”，复制粘贴tls-auth.key路径，密钥方向“客户端（1）”

tail -f /var/log/syslog：

debian NetworkManager[648]: <info>  [1609951704.7482] audit: op="statistics" arg="refresh-rate-ms" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info>  [1609951706.1485] audit: op="connection-activate" uuid="1afd25e7-f3cd-472d-9a3b-31f1ad390479" name="VPN-NAME" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info>  [1609951706.1505] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: Started the VPN service, PID 6763
debian NetworkManager[648]: <info>  [1609951706.1554] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: Saw the service appear; activating connection
debian NetworkManager[648]: <info>  [1609951706.1591] audit: op="statistics" arg="refresh-rate-ms" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info>  [1609951706.2483] audit: op="statistics" arg="refresh-rate-ms" pid=2126 uid=1000 result="success"
debian NetworkManager[648]: <info>  [1609951711.8373] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: state changed: starting (3)
debian nm-openvpn[6766]: OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
debian nm-openvpn[6766]: library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
debian nm-openvpn[6766]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
debian nm-openvpn[6766]: TCP/UDP: Preserving recently used remote address: [AF_INET]A.B.C.D:1194
debian nm-openvpn[6766]: UDP link local: (not bound)
debian nm-openvpn[6766]: UDP link remote: [AF_INET]A.B.C.D:1194
debian nm-openvpn[6766]: NOTE: chroot will be delayed because of --client, --pull, or --up-delay
debian nm-openvpn[6766]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
debian NetworkManager[648]: <warn>  [1609951772.4259] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN connection: connect timeout exceeded.
debian nm-openvpn-serv[6763]: Connect timer expired, disconnecting.
debian NetworkManager[648]: <warn>  [1609951772.4316] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: failed: connect-failed (1)
debian nm-openvpn[6766]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
debian NetworkManager[648]: <info>  [1609951772.4317] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: state changed: stopping (5)
debian nm-openvpn[6766]: TLS Error: TLS handshake failed
debian NetworkManager[648]: <info>  [1609951772.4317] vpn-connection[0x55ce8e0d02e0,1afd25e7-f3cd-472d-9a3b-31f1ad390479,"VPN-NAME",0]: VPN plugin: state changed: stopped (6)
debian nm-openvpn[6766]: SIGTERM[hard,tls-error] received, process exiting

操作系统环境：
Debian 10 (buster)
内核Linux debian 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64 GNU/Linux
网络管理器：network-manager/stable,now 1.14.6-2+deb10u1 amd64
OpenVPN插件：network-manager-openvpn/stable,now 1.8.10-1 amd64
OpenVPN独立客户端（openvpn命令）：

OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10

从表面上看syslog，网络管理器的 OpenVPN 插件要么使用已经安装的底层openvpn，要么具有随插件本身的安装而带来的独立客户端，它具有与独立客户端相同的功能/能力甚至版本openvpn。

然后，它就不工作了（但只能从网络管理器，独立运行）...

答案1

network-manager-openvpn（可能还有 network-manager-openvpn-gnome）软件包无法保存 tls-auth 字段。我使用的是 Ubuntu 22.04.3 LTS 和 network-manager-openvpn 1.8.18-1。我导入了一个 OpenVPN 配置文件，除与 tls-auth 相关的字段外，所有字段都已正确填写。即使在编辑这些字段后，这些值也不会保存。但是，我能够使用 nmcli 编辑 VPN 连接，将“ta”（TLS-Auth 密钥文件）和“ta-dir”（密钥方向）的值添加到 vpn.data。然后，网络管理器成功连接。配置对话框甚至显示正确的值；它似乎无法保存它们。

我不确定这些错误的状态。以下是一份错误报告，声称该问题已于 2018 年在 NetworkManager-openvpn-1.8.8-1.fc29 中修复：https://bugzilla.redhat.com/show_bug.cgi?id=1639811

以下是一份最新的错误报告，描述了我看到的几乎相同的软件包版本的情况：https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/105

相关内容