dco_get_peer_stats fails at startup #643
Comments
|
I may have found the cause of the problem, a permission issue. Using DCO requires ROOT permissions. user root Now I can connect to ubuntu 24.0.4, but I still have problems connecting to pfsense freebsd openvpn DCO Nov 19 11:40:30 openvpn 33936 SIGUSR1[soft,process-push-msg-failed] received, process restarting |
yes, normally you'd start openvpn as root, unless you're dropping privileges later. |
|
After I set the permissions,It seems there is still a problem 2024-11-20 11:37:08 UID set to root sudo setcap cap_setpcap,cap_net_admin,CAP_IPC_LOCK,CAP_NET_BIND_SERVICE,CAP_SETGID,CAP_SETUID,CAP_SYS_CHROOT,CAP_DAC_OVERRIDE,CAP_AUDIT_WRITE,cap_net_raw+ep /usr/sbin/openvpn |
|
If I remove CAP_SETPCAP , then log show 12:13:59 --user specified but lacking CAP_SETPCAP. Cannot retain CAP_NET_ADMIN. Disabling data channel offload |
|
So the problem is not solved. |
|
Setting up ROOT did not solve the problem. user root |
|
this added CAP_SETPCAP 2024-11-20 13:22:24 us=494734 Current Parameter Settings: |
this seems a different problem. |
|
mode p2p |
|
other side pfsense openvpn log show: Nov 20 17:10:42 | openvpn | 85204 | OPTIONS IMPORT: Server did not request DATA_V2 packet format required for data channel offload |
|
I am not fully understanding. In the config you posted you wrote |
|
is the other side configured as |
|
This is... interesting. So, for DCO to work, you need Seeing the pfsense side send a PUSH_REQUEST, my guess right now is that the pfsense is using This all said, I think you are triggering a bug on the Anyway, we should look into that case (that is, |
My crystal ball says it is ;-) |
i using openvpn for p2p mode tunnel. |
|
pfsense side config dev ovpnc8
|
|
That will most certainly cause problems.
You will not be able to connnect to a p2p peer with tls-crypt-v2. I doubt that the config matches the log from the other side/config from the other side. |
I also have this feeling. Did you post your |
i try deleted the two tls-crypt-v2 /root/v2crypt-client-1.key |
yes, i had post it. |
it seems that the configuration you have posted and the log do not truly match. |
question: does openvpn stop after this message? Or it simply continue to run? |
|
btw make sure to remove the |
|
this now pfsense side config, some ips hide. dev ovpnc8 this ubuntu side cnfig: #mode p2p port 51758 dev-type tun #explicit-exit-notify 1 tun-mtu 1430 remote-cert-tls client float auth SHA3-256 #tls-crypt-v2 v2crypt-server.key #topology p2p ifconfig 10.11.3.1 10.11.3.2 keepalive 10 60 |
yes, i had remove pull |
|
ubuntu side log: 2024-11-20 18:50:30 us=322724 Current Parameter Settings: |
continue to run |
|
if i want to using ifconfig 10.11.3.1 10.11.3.2, ifconfig-ipv6 2a0d:2408:513:a::2/124 2a0d:2408:513:a::3 |
ok, then this is not a real problem. it's just the statistics polling that fails because no peer is yet connected. You can ignore that message |
this looks good to me, as long as it's inverted on the other peer. Please make sure to remove |
some connection is happening here on ubuntu. Please show the log from the pfsense side. |
Nov 20 19:16:15 openvpn 57098 UDPv6 link remote: [AF_INET6]2a04:e8c:18:71a::1:51758 |
here it says that you are still using |
I did not configure additional pull parameters. pfsense only has ifconfig 10.11.3.2 10.11.3.1 |
|
Your config is still extremely questionable. tls-crypt-v2 basically requires pull to actually work properly. |
Removed tls-crypt-v2, same result Nov 20 20:23:03 openvpn 56039 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts |
|
when i setup add mode server, ubuntu log show us=458249 Note: NOT using '--topology subnet' disables data channel offload. |
|
when add topology subnet,ubuntu log show: 2024-11-20 20:40:32 us=695056 open_tun_dco: FRAvpn |
|
So now the question is how does DCO work in P2P mode? |
|
@liuxyon it works fine in p2p mode but what you shown as configs and message you presented, suggests that you don't actually understand what p2p mode is. You want p2p mode but are saying messages like
Also your logs/config and what you are saying is all contradiction each other, so it really hard for us to make sense of what you are actually doing. |
I have tried all the settings you mentioned, and I have shown my configuration. That is to say, there is no known parameter configuration that can work p2p DCO mode |
|
I have to use encrypted data packet headers, otherwise they will be recognized and blocked by GFW. |
The concept of encrypted data packet headers does not exist in OpenVPN. |
pfsense keeps showing this. it means that it is somehow enabling --pull again. However, please note that this is a bug tracker, not a support channel. |
|
When DCO is not used, these configurations do not affect operation. Because I use it to establish BGP tunnel.It should be P2P mode. where mailing list? |
|
@liuxyon we tested p2p mode with DCO and it works. However, we lost faith in your ability to setup it correctly, so we are no longer treating this issue as a bug report/issue but rather as a user configuration and as thus, it does not belong on this issue tracker. |
|
Give me your correct configuration, I didn't find anything about DCO p2p correct configuration on the Internet. |
|
This issue is closed. Please write to the mailing list or join IRC. |
linux-image-6.11.8-x64v4-xanmod1
Originally posted by @liuxyon in OpenVPN/ovpn-dco#50 (comment)
The text was updated successfully, but these errors were encountered: