OpenVPN 从 CLI 工作但不通过 NetworkManager GUI

Question

我通过 CLI 建立了一个有效的 VPN 连接：

sudo openvpn myconfigfile.ovpn

我在网络管理器 GUI 中导入了该文件，当我尝试使用它时，它总是失败，但我找不到原因。我通过以下方式查看了 NetworkManager 的日志：

journalctl -u NetworkManager 

它给出了这个：

sept. 06 09:30:56 alt-machine NetworkManager[19942]: <info>  [1504683056.7617] audit: op="connection-activate" uuid="24fc3644-b324-46a4-9ce1-c1a0fcea1b75" name="name-of-connection" pid=3406 uid=1000 result="success"
sept. 06 09:30:56 alt-machine NetworkManager[19942]: <info>  [1504683056.7900] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: Started the VPN service, PID 23791
sept. 06 09:30:56 alt-machine NetworkManager[19942]: <info>  [1504683056.8118] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: Saw the service appear; activating connection
sept. 06 09:30:56 alt-machine nm-openvpn[23798]: OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 22 2017
sept. 06 09:30:56 alt-machine nm-openvpn[23798]: library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
sept. 06 09:30:56 alt-machine NetworkManager[19942]: <info>  [1504683056.9251] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: VPN plugin: state changed: starting (3)
sept. 06 09:30:56 alt-machine NetworkManager[19942]: <info>  [1504683056.9251] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: VPN connection: (ConnectInteractive) reply received
sept. 06 09:30:57 alt-machine nm-openvpn[23798]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
sept. 06 09:30:57 alt-machine nm-openvpn[23798]: TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:port
sept. 06 09:30:57 alt-machine nm-openvpn[23798]: UDP link local: (not bound)
sept. 06 09:30:57 alt-machine nm-openvpn[23798]: UDP link remote: [AF_INET]x.x.x.x:port
sept. 06 09:30:57 alt-machine nm-openvpn[23798]: NOTE: chroot will be delayed because of --client, --pull, or --up-delay
sept. 06 09:30:57 alt-machine nm-openvpn[23798]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
sept. 06 09:31:56 alt-machine NetworkManager[19942]: <warn>  [1504683116.7116] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: VPN connection: connect timeout exceeded.
sept. 06 09:31:56 alt-machine nm-openvpn-serv[23791]: Connect timer expired, disconnecting.
sept. 06 09:31:56 alt-machine NetworkManager[19942]: <warn>  [1504683116.7199] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: VPN plugin: failed: connect-failed (1)
sept. 06 09:31:56 alt-machine NetworkManager[19942]: <info>  [1504683116.7208] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: VPN plugin: state changed: stopping (5)
sept. 06 09:31:56 alt-machine NetworkManager[19942]: <info>  [1504683116.7210] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: VPN plugin: state changed: stopped (6)

还有其他日志可以查看吗？

Answer 1

对我来说，spotter 的答案就是解决方案。他解决了这个问题并提交了错误报告。

https://bugs.launchpad.net/ubuntu/+source/network-manager-openvpn/+bug/1847144

详细说明解决问题的步骤：

我正在使用 KDE。可能是网络管理器界面不同。这就是我所做的。将 openvpn 配置文件导入到网络管理器中。它建立连接，超时，并且没有任何调试级别提供更多提示。从命令行连接工作正常。

我编辑 openvpn 文件，并将密钥块提取到一个文件中。它是中间的关键块，所以我的文本文件如下所示：

-----BEGIN OpenVPN Static key V1-----
92e2de5ae643729863zzzz4a0ebe952
.
.
.

cc05zxzxczczxxczxzxczxce902b498a5
-----END OpenVPN Static key V1-----

我将它保存为 openvpn_cryptkey.key

然后

• 打开已经导入 networkmanager 的 openvpn 连接
• 在 VPM (openvpn) 选项卡上选择 Advanced...，选择 TLS Settings，然后只更改两件事

模式是 TLS-Crypt

和密钥文件，使用之前创建的密钥文件的路径。

立即，连接工作

Answer 2

更改 NetworkManager 的日志级别以仔细检查 syslog 中发生的情况：

终端：

sudo NetworkManager --log-level=DEBUG
sudo tail -f /var/log/syslog

尝试通过 NetworkManger 再次连接 VPN，并在系统日志中查找相关消息nm-openvpn。就我而言，它是 .crt 文件路径中的一个字母空格：

nm-openvpn[1957]: Options error: --ca fails with '/home/user/IPVanish%20config/ca.ipvanish.com.crt': No such file or directory (errno=2)

因此，我通过删除配置文件路径中的字母空格来解决该问题。

更多： https ://forums.linuxmint.com/viewtopic.php?f=90&t=272916#p1510747

稍后将日志级别重置回 INFO。

Answer 3

就像错误输出所说：
sept. 06 09:30:57 alt-machine nm-openvpn[23798]: NOTE: chroot will be delayed because of --client, --pull, or --up-delay sept. 06 09:30:57 alt-machine nm-openvpn[23798]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay sept. 06 09:31:56 alt-machine NetworkManager[19942]: <warn> [1504683116.7116] vpn-connection[0x55e876784720,24fc3644-b324-46a4-9ce1-c1a0fcea1b75,"name-of-connection",0]: VPN connection: connect timeout exceeded.

可能您的证书仍然无法绑定链接。试试这个步骤。将myconfigfile.ovpn文件移至/etc/NetworkManager/system-connectionsNetworkManager 服务，然后重新启动。并将 CA 的目录访问权限从ca = /folderTo/vpn-ca.crt.更改为ca = /folderTo/vpn.ovpn. 并删除[ipv6] method=auto.

希望这可以帮助。