Main/master, big change in openvpn config setup?

Installing and Using OpenWrt
1

Have anyone manage to build in main a working openvpn-openssl package since kernel 6.12.55?
Every build I have tried after kernel 6.12.55 the package is always in the manifest list but it doesn't exist in the build, there are no traces of it in the log, it doesn't start or can't be found in any operational report anywhere in the working router (all routers).
But it is listed as installed in the software list!?

And the etc/openvpn dir is nowhere to be found so there is no where to put the config file anymore?

2

For main/ master branch you need luci-proto-openvpn.
It has become a protocol which you configure on the interface.
It was a bumpy switch but it sort of works now.

3

Isn’t it possible to simply add the vpn server config in a directory and rock’n’roll anymore?

4

Yes that is possible again after discusion with the devs.
There is a config tab where you can download your config.

P.S. do not forget to setup the firewall

5

So now I have installed the luci-proto-openvpn.

but still no traces of any ”openvpn interface”, where is it supposed to be found?

Still no etc/openvpn dir for the config.

6

I found it…

It is found by creating a new network interface with openvpn as protocol.

7

I have no time to dig in to the details of these changes right now. But as far as I can see right now, openvpn will now be its own free standing interface instead of the old tun device integrated in a interface.

So that means the openvpn interface will from now on also be its own interface instead in defined firewall zone and normal firewall zone rules apply for data between the different interfaces?

8

Unfortunately not
It was requested that if you use the GUI e.g. to set dev tun1 it would set the l3 device on the interface but last time I checked that was still not working/implemented.
But if you use a config file then the interface does not read the config file for your device so you have to either add an extra interface with unmanaged protocol and set the device there and use that interface for the firewall (which then can also be used for PBR) or create a firewall zone and add the device you are using (e.g. tun1) to that firewall zone.

I will do a write up for setting it up when I have time

P.S. Can you adapt the title to show it is only in Main/Master branch?

9

I have started to work on it see:
OpenVPN setup guide Master branch

It is very much a W.I.P.

10

Made a new more specified title to the tread.

11

I am working on setup instructions,
I just uploaded the latest, but it is very much a W.I.P and I mean the switch to protocol.

12

Trying to figure out the benefits to this change.

Is there a simple explanation?

13

It is now a netifd interface managed by netifd

But you should ask the developers I am merely the messenger

14

I am thinking about this also, played around tonight in this.

As far as I can see the biggest difference right here is that the config data from the config file is put in a interface in the network config.

And all the key and cert files are put in the old etc/openvpn directory and called from there from the network config.

So the feeling right now is that we walk around the river to get the water, but maybe I don’t understand this right now.

15

In my case it seems the best way to embrace this change is to abandon the old server config file I had and to implement the server setup mostly under the network part in my ”setup script” I have made over the years.

But still, I need to understand what is actually needed to get this system up and running first before changing my setup script…

16

And this is what I’m thinking. I’ve got a script that transforms Gargoyle web UI input into .conf (and keys,certs etc). This could now be simplified as the UI can write directly to uci and it should “just work”?

But we do so much already with creating clients, revoking and blocking certificates etc I don’t know what benefit I would get from hacking up my script into pieces.

Not against the change just not sure it benefits someone with a well established script.

17

Using a config file is working for me, see my notes:
OpenVPN setup guide Master branch

18

True!

I just feel that the overall positive side effects in the long run probably work better for me if I make the effort now to implement it in my setup script.

In this story there are also the OpenVPN 2.7 upgrade that comes with some new things…

So it isn’t only the placement of the config file.

19

Good luck with it

I have made a script to convert config to uci not yet finished and tested though:

20

When openvpn is a protocol.
Do anyone know how to correctly reload openvpn changes in the network config or changes of crypto keys or cert files?