Почему не могу подключиться к openvpn?

Question

[DVoropaev]

Файл ./client.conf:

client
dev tap
dev-type tap
persist-tun
persist-key
proto tcp-client
cipher BF-CBC
auth SHA512
remote vpn1.<адрес скрыт>.ru
port 8217
ca /home//.cert/217/ca.crt
tls-auth /home//.cert/217/ta.key 1
tls-client
comp-lzo yes
key /home//.cert/217/.key
cert /home//.cert/217/.crt

sudo openvpn --config ./client.conf --askpass ./passw
Tue Sep  5 18:42:52 2017 OpenVPN 2.3.14 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec  7 2016
Tue Sep  5 18:42:52 2017 library versions: OpenSSL 1.0.2j-fips  26 Sep 2016, LZO 2.08
Tue Sep  5 18:42:52 2017 WARNING: file './passw' is group or others accessible
Tue Sep  5 18:42:52 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Sep  5 18:42:52 2017 WARNING: file '/home/<username>/.cert/217/<username>.key' is group or others accessible
Tue Sep  5 18:42:52 2017 WARNING: file '/home/<username>/.cert/217/ta.key' is group or others accessible
Tue Sep  5 18:42:52 2017 Control Channel Authentication: using '/home/<username>/.cert/217/ta.key' as a OpenVPN static key file
Tue Sep  5 18:42:52 2017 Attempting to establish TCP connection with [AF_INET]<ip скрыт>:8217 [nonblock]
Tue Sep  5 18:42:53 2017 TCP connection established with [AF_INET]<ip скрыт>:8217
Tue Sep  5 18:42:53 2017 TCPv4_CLIENT link local: [undef]
Tue Sep  5 18:42:53 2017 TCPv4_CLIENT link remote: [AF_INET]<ip скрыт>:8217
Tue Sep  5 18:42:54 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Sep  5 18:42:54 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Sep  5 18:42:54 2017 [<сервер скрыт>] Peer Connection Initiated with [AF_INET]<ip скрыт>:8217
Tue Sep  5 18:42:56 2017 TUN/TAP device tap1 opened
Tue Sep  5 18:42:56 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Sep  5 18:42:56 2017 /usr/sbin/ip link set dev tap1 up mtu 1500
Tue Sep  5 18:42:56 2017 /usr/sbin/ip addr add dev tap1 <ip скрыт>/27 broadcast <ip скрыт>
RTNETLINK answers: File exists
Tue Sep  5 18:42:56 2017 ERROR: Linux route add command failed: external program exited with error status: 2
Tue Sep  5 18:42:56 2017 Initialization Sequence Completed
Tue Sep  5 18:43:00 2017 Connection reset, restarting [0]
Tue Sep  5 18:43:00 2017 SIGUSR1[soft,connection-reset] received, process restarting
Tue Sep  5 18:43:05 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Sep  5 18:43:05 2017 Attempting to establish TCP connection with [AF_INET]<ip скрыт>:8217 [nonblock]
Tue Sep  5 18:43:06 2017 TCP connection established with [AF_INET]<ip скрыт>:8217
Tue Sep  5 18:43:06 2017 TCPv4_CLIENT link local: [undef]
Tue Sep  5 18:43:06 2017 TCPv4_CLIENT link remote: [AF_INET]<ip скрыт>:8217
Tue Sep  5 18:43:07 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Sep  5 18:43:07 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Sep  5 18:43:07 2017 [<сервер скрыт>] Peer Connection Initiated with [AF_INET]<ip скрыт>:8217
Tue Sep  5 18:43:09 2017 Preserving previous TUN/TAP instance: tap1
Tue Sep  5 18:43:09 2017 Initialization Sequence Completed
Tue Sep  5 18:43:14 2017 Connection reset, restarting [0]

Answer 1

[Александр Черных]

помоему дело в этом

ERROR: Linux route add command failed: external program exited with error status: 2

клиент опенвпн добавляет маршруты в таблицу маршрутизации на что требуются права админа.

Comments

[DVoropaev]

я под sudo запускаю, что его не устраивает?

[Александр Черных]

не может добавить маршрут. И кроме того Вы уверены, что должен быть tap интерфейс? На той стороне тоже tap?

[Александр Черных]

команда
id
в консоли что показывает?

[DVoropaev]

Александр Черных, да. используется tap (конфиг мне прислали с "той стороны")
а вот что нужно сделать, чтобы клиент мог добавить маршрут?

[Александр Черных]

id
в консоли что показывает?

[DVoropaev]

Александр Черных,

id
uid=1000(dproger gid=1000(dproger) группы=1000(dproger),10(wheel) контекст=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

sudo id
uid=0(root) gid=0(root) группы=0(root) контекст=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[younghacker]

Tue Sep  5 18:42:56 2017 /usr/sbin/ip link set dev tap1 up mtu 1500
Tue Sep  5 18:42:56 2017 /usr/sbin/ip addr add dev tap1 <ip скрыт>/27 broadcast <ip скрыт>
RTNETLINK answers: File exists
Tue Sep  5 18:42:56 2017 ERROR: Linux route add command failed: external program exited with error status: 2

Что показывает
ip a
нет ли там дубликата адреса или интерфейса который пытается поднять openvpn.

[mureevms]

Только хотел написать, что быть может впн уже подключен

[DVoropaev]

younghacker,

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:______:17 brd ff:ff:ff:ff:ff:ff
    inet 172______74/24 brd 172______255 scope global dynamic enp3s0
       valid_lft 5960sec preferred_lft 5960sec
    inet6 fe80:______:ab17/64 scope link 
       valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:______:d7 brd ff:ff:ff:ff:ff:ff
    inet 192.______.1/24 brd 192.______255 scope global virbr0
       valid_lft forever preferred_lft forever
4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000
    link/ether 52______d7 brd ff:ff:ff:ff:ff:ff
5: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/ether be:______:f1 brd ff:ff:ff:ff:ff:ff
    inet 10.______.7/27 brd 10.______.31 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::______:e3f1/64 scope link 
       valid_lft forever preferred_lft forever

[younghacker]

dableproger, если опасаетесь публиковать локальные IP то можете написать мне в скайп. Без адресов я не могу угадать совпадают они или нет. Интерфейс вижу, он другой: tap0 в ip a и tap1 в логе.
Информативность лога поднимите до 6-ки.
verb 6
ip route бы ещё спросил но с <адрес скрыт> в этом мало смысла. :)