Duplicate openvpn service

Installing and Using OpenWrt
1

I believe i have 2 instances of openvpn running (See log below). Please excuse my lack of linux knowledge here but how do i stop one of them; keeping the one i want/configured? Because IT DOES WORK (my clients connect), so the error and subsequent exiting must be the duplicate service.
OR maybe the executable is trying to be started multiple times

Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: OpenVPN 2.4.6 arm-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: library versions: OpenSSL 1.0.2q  20 Nov 2018, LZO 2.10
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: Diffie-Hellman initialized with 2048 bit key
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: TUN/TAP device tun1 opened
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: TUN/TAP TX queue length set to 100
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: /sbin/ifconfig tun1 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue Feb 26 08:30:15 2019 daemon.warn openvpn(skittles_vpn_server)[8037]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Tue Feb 26 08:30:15 2019 daemon.err openvpn(skittles_vpn_server)[8037]: TCP/UDP: Socket bind failed on local address [AF_INET][undef]:1194: Address in use (errno=98)
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: Exiting due to fatal error
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: Closing TUN/TAP interface
Tue Feb 26 08:30:15 2019 daemon.notice openvpn(skittles_vpn_server)[8037]: /sbin/ifconfig tun1 0.0.0.0

an overview of my files regarding openvpn

/etc/config/openvpn - (this is the file i configured)

/etc/init.d/openvpn

/etc/openvpn/vpnclient.ovpn
/etc/openvpn/vpnserver.conf

/usr/sbin/openvpn

2

You can verify the amount of openvpn processes by ps wwww | grep vpn
What are the contents of /etc/config/openvpn ?

1 Like
3

idk whats up with "ps" but this is all it outputs

root@OpenWrt:~# ps
  PID TTY          TIME CMD
 1745 pts/0    00:00:00 ps
30207 pts/0    00:00:00 ash

contents of /etc/config/openvpn - I changed the names after my original post so names will not match. these were sample_client & sample_server

config openvpn 'custom_config'
	option config '/etc/openvpn/my-vpn.conf'

config openvpn 'skittles_vpn_server'
	option port '1194'
	option proto 'udp'
	option dev 'tun'
	option ca '/etc/easy-rsa/pki/ca.crt'
	option cert '/etc/easy-rsa/pki/issued/vpnserver.crt'
	option key '/etc/easy-rsa/pki/private/vpnserver.key'
	option dh '/etc/easy-rsa/pki/dh.pem'
	option server '10.8.0.0 255.255.255.0'
	option ifconfig_pool_persist '/tmp/ipp.txt'
	option keepalive '10 120'
	option compress 'lzo'
	option persist_key '1'
	option persist_tun '1'
	option user 'nobody'
	option status '/tmp/openvpn-status.log'
	option verb '3'
	option enabled '1'

config openvpn 'skittles_vpn_client'
	option client '1'
	option dev 'tun'
	option proto 'udp'
	list remote 'my_server_1 1194'
	option resolv_retry 'infinite'
	option nobind '1'
	option persist_key '1'
	option persist_tun '1'
	option user 'nobody'
	option ca '/etc/openvpn/ca.crt'
	option cert '/etc/openvpn/client.crt'
	option key '/etc/openvpn/client.key'
	option compress 'lzo'
	option verb '3'
	option enabled '0'
4

I'll tell you what is wrong, you skipped the wwww | grep vpn part of the command.

Looks like there is a vpn server running on port 1194 named skittles_vpn_server.
Also there is some custom config in /etc/openvpn/my-vpn.conf
What is the content of that file?

1 Like
5

Your config tries to start three instances: one client, one server, and one with whatever my-vpn.conf says to do.

But, all files named *.conf in /etc/openvpn will be automatically parsed by every instance of OpenVPN. You don't want that, so name the custom config .ovpn instead or store it somewhere else.

1 Like
6

Client is not enabled.

3 Likes
7

Yes, right.

2 Likes
8

i had tried it with those params but it just outputed the process for the command itself

root@OpenWrt:~# ps wwww | grep vpn
9876 pts/0 S+ 0:00 grep vpn

/etc/openvpn/my-vpn.conf
this file doesnt exist

9

Your server doesn't start because something else has already opened port 1194.

If you aren't using the "custom_config" instance, delete that section from /etc/config/openvpn. And make sure that there are no files named *.conf in /etc/openvpn.

2 Likes
10

i did comment that section out

fyi my server does start and works
thats why i said i think its 2 instances of openvpn causing this

11

there is one other file i missed listing, but i dont think its doing anything

etc/config/openvpn_recipes


#
# Routed point-to-point server
#
config openvpn_recipe server_tun_ptp
	option _description	'Simple server configuration for a routed point-to-point VPN'
	option _role		'server'
	option dev		'tun'
	option ifconfig		'10.0.0.1 10.0.0.2'
	option secret		'shared-secret.key'
	option keepalive	'10 60'
	option comp_lzo		'yes'
	option verb		'3'
	option mssfix		'1420'

#
# Routed point-to-point client
#
config openvpn_recipe client_tun_ptp
	option _description	'Simple client configuration for a routed point-to-point VPN'
	option _role		'client'
	option dev		'tun'
	list remote		'vpnserver.example.org'
	option ifconfig		'10.0.0.2 10.0.0.1'
	option secret		'shared-secret.key'
	option nobind		'1'
	option comp_lzo		'yes'
	option verb		'3'

#
# Routed multi-client server
#
config openvpn_recipe server_tun
	option _description	'Server configuration for a routed multi-client VPN'
	option _role		'server'
	option dev		'tun'
	option server		'10.0.100.0 255.255.255.0'
	option ca		'ca.crt'
	option cert		'server.crt'
	option key 		'server.key'
	option dh 		'dh1024.pem'
	option keepalive	'10 60'
	option comp_lzo		'yes'
	option verb		'3'
	option mssfix		'1420'

#
# Routed client
#
config openvpn_recipe client_tun
	option _description	'Client configuration for a routed multi-client VPN'
	option _role		'client'
	option client		'1'
	option dev		'tun'
	list remote		'vpnserver.example.org'
	option pkcs12		'my_client.p12'
	option remote_cert_tls	'server'
	option comp_lzo		'yes'
	option nobind		'1'
	option persist_key	'1'
	option persist_tun	'1'
	option verb		'3'
	option reneg_sec	'0'
	option float		'1'

#
# Multi-client ethernet bridge server
#
config openvpn_recipe server_tap_bridge
	option _description	'Server configuration for an ethernet bridge VPN'
	option _role		'server'
	option dev		'tap'
	option server_bridge	'192.168.1.1 255.255.255.0 192.168.1.128 192.168.1.254'
	option ca		'ca.crt'
	option cert		'server.crt'
	option key 		'server.key'
	option dh 		'dh1024.pem'
	option keepalive	'10 60'
	option comp_lzo		'yes'
	option verb		'3'
	option mssfix		'1420'

#
# Ethernet bridge client
#
config openvpn_recipe client_tap_bridge
	option _description	'Client configuration for an ethernet bridge VPN'
	option _role		'client'
	option client		'1'
	option dev 		'tap'
	list remote		'vpnserver.example.org'
	option ca 		'ca.crt'
	option cert		'my_client.crt'
	option key 		'my_client.key'
	option dh 		'dh1024.pem'
	option remote_cert_tls	'server'
	option comp_lzo		'yes'
	option nobind		'1'
	option persist_key	'1'
	option verb		'3'
	option reneg_sec	'0'
	option float		'1'
12

You can safely use *.conf, if you don't need instance management.
Otherwise just add a UCI-section for that configuration:
https://openwrt.org/docs/guide-user/services/vpn/openvpn/extras#instance_management

1 Like
13

Check what is running on port 1194
netstat -anp | grep 1194

2 Likes
14

root@OpenWrt:~# netstat -anp | grep 1194
udp 0 0 0.0.0.0:1194 0.0.0.0:* 14153/openvpn

FYI
the name in the log has changed, here is the latest log

Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: OpenVPN 2.4.6 arm-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: library versions: OpenSSL 1.0.2q 20 Nov 2018, LZO 2.10
Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: Diffie-Hellman initialized with 2048 bit key
Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Feb 27 08:25:46 2019 daemon.err openvpn(vpnserver)[15271]: ERROR: Cannot ioctl TUNSETIFF tun0: Resource busy (errno=16)
Wed Feb 27 08:25:46 2019 daemon.notice openvpn(vpnserver)[15271]: Exiting due to fatal error

notice how its "vpnserver" now

15

netstat shows there is already an OpenVPN process running with process id 14153, and it has control of port 1194. The process 14153 should be in the ps list. A second instance 15271 tries to start but can't because the port is in use.

1 Like
16

thank you that makes sense (kinda what i figured)
how do i stop the second process? and disable indefinitely?
how do i know what configuration file is linked to it so i can set enabled to 0

17

Your /etc/config/openvpn file should contain only one config openvpn main block. Your /etc/openvpn directory should contain no files that end in .conf.

2 Likes
18

thank you, that does kinda resolve it
but now i get

Wed Feb 27 08:38:29 2019 daemon.err openvpn(vpnserver)[16011]: Options error: In [CMD-LINE]:1: Error opening configuration file: /etc/openvpn/vpnserver.conf
Wed Feb 27 08:38:29 2019 daemon.warn openvpn(vpnserver)[16011]: Use --help for more information.

what is telling this other process to start

19

i see this in /etc/init.d/openvpn
which might be the culprit


#!/bin/sh /etc/rc.common
# Copyright (C) 2008-2013 OpenWrt.org
# Copyright (C) 2008 Jo-Philipp Wich
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.

START=90
STOP=10

USE_PROCD=1
PROG=/usr/sbin/openvpn

LIST_SEP="
"

UCI_STARTED=
UCI_DISABLED=

append_param() {
	local s="$1"
	local v="$2"
	case "$v" in
		*_*_*_*) v=${v%%_*}-${v#*_}; v=${v%%_*}-${v#*_}; v=${v%%_*}-${v#*_} ;;
		*_*_*)   v=${v%%_*}-${v#*_}; v=${v%%_*}-${v#*_} ;;
		*_*)     v=${v%%_*}-${v#*_} ;;
	esac
	echo -n "$v" >> "/var/etc/openvpn-$s.conf"
	return 0
}

append_bools() {
	local p; local v; local s="$1"; shift
	for p in $*; do
		config_get_bool v "$s" "$p"
		[ "$v" = 1 ] && append_param "$s" "$p" && echo >> "/var/etc/openvpn-$s.conf"
	done
}

append_params() {
	local p; local v; local s="$1"; shift
	for p in $*; do
		config_get v "$s" "$p"
		IFS="$LIST_SEP"
		for v in $v; do
			[ -n "$v" ] && [ "$p" != "push" ] && append_param "$s" "$p" && echo " $v" >> "/var/etc/openvpn-$s.conf"
			[ -n "$v" ] && [ "$p" == "push" ] && append_param "$s" "$p" && echo " \"$v\"" >> "/var/etc/openvpn-$s.conf"
		done
		unset IFS
	done
}

append_list() {
	local p; local v; local s="$1"; shift

	list_cb_append() {
		v="$1:${v}"
	}

	for p in $*; do
		config_list_foreach "$s" "$p" list_cb_append
	done
	[ -n "$v" ] && append_param "$s" "$p" && echo " ${v%*:}" >> "/var/etc/openvpn-$s.conf"
}

section_enabled() {
	config_get_bool enable  "$1" 'enable'  0
	config_get_bool enabled "$1" 'enabled' 0
	[ $enable -gt 0 ] || [ $enabled -gt 0 ]
}

openvpn_add_instance() {
	local name="$1"
	local dir="$2"
	local conf="$3"

	procd_open_instance "$name"
	procd_set_param command "$PROG"	\
		--syslog "openvpn($name)" \
		--status "/var/run/openvpn.$name.status" \
		--cd "$dir" \
		--config "$conf"
	procd_set_param file "$dir/$conf"
	procd_set_param term_timeout 15
	procd_set_param respawn
	procd_append_param respawn 3600
	procd_append_param respawn 5
	procd_append_param respawn -1
	procd_close_instance
}

start_instance() {
	local s="$1"

	config_get config "$s" config
	config="${config:+$(readlink -f "$config")}"

	section_enabled "$s" || {
		append UCI_DISABLED "$config" "$LIST_SEP"
		return 1
	}

	[ ! -d "/var/run" ] && mkdir -p "/var/run"

	if [ ! -z "$config" ]; then
		append UCI_STARTED "$config" "$LIST_SEP"
		openvpn_add_instance "$s" "${config%/*}" "$config"
		return
	fi

	[ ! -d "/var/etc" ] && mkdir -p "/var/etc"
	[ -f "/var/etc/openvpn-$s.conf" ] && rm "/var/etc/openvpn-$s.conf"

	append_bools "$s" $OPENVPN_BOOLS
	append_params "$s" $OPENVPN_PARAMS
	append_list "$s" $OPENVPN_LIST

	openvpn_add_instance "$s" "/var/etc" "openvpn-$s.conf"
}

start_service() {
	local instance="$1"
	local instance_found=0

	config_cb() {
		local type="$1"
		local name="$2"
		if [ "$type" = "openvpn" ]; then
			if [ -n "$instance" -a "$instance" = "$name" ]; then
				instance_found=1
			fi
		fi
	}

	. /usr/share/openvpn/openvpn.options
	config_load 'openvpn'

	if [ -n "$instance" ]; then
		[ "$instance_found" -gt 0 ] || return
		start_instance "$instance"
	else
		config_foreach start_instance 'openvpn'

		local path name
		for path in /etc/openvpn/*.conf; do
			if [ -f "$path" ]; then
				name="${path##*/}"; name="${name%.conf}"

				# don't start configs again that are already started by uci
				if echo "$UCI_STARTED" | grep -qxF "$path"; then
					continue

				# don't start configs which are set to disabled in uci
				elif echo "$UCI_DISABLED" | grep -qxF "$path"; then
					logger -t openvpn "$name.conf is disabled in /etc/config/openvpn"
					continue
				fi

				openvpn_add_instance "$name" "${path%/*}" "$path"
			fi
		done
	fi
}

service_triggers() {
	procd_add_reload_trigger openvpn
}

do i just delete this file?
will the existing working service startup automatically next time i reboot if i delete this?

20 
ls -l /etc/openvpn
uci show openvpn
2 Likes