OpenVPN client on virtual machine with Ubuntu18 OS on Microsoft Azure cannot start.

[linexc]

Dear Developers,

I have an openVPN config file for accessing lab network in oder to ingest data from an installed opcua server. Since my receiver is deployed on an Ubuntu virtual machine on Azure, I decided to install the openvpn3 client and import config file into it. However, everytime when I tried running the client, the command window stuck directly after I input the password to this lab network.

When I tried looking at the log there was something wrong as below.

How do I fix the problem?
Thanks for your help.

[dsommers]

@linexc Hey, it instantly sounds like the default gateway is replaced when the connection starts. But that needs to be verified more closely.

The openvpn3 log command is a good starting point. But could you try to start the session using /usr/bin/openvpn2 --config custconfig.ovpn --verb 6 first? And provide the log data there? The section from the Sending PUSH_REQUEST to server... line until the session is established/connected are the interesting ones in this case.

[linexc]

Hi @dsommers
it seems it connects. Am I right?

[dsommers]

@linexc Run openvpn3 sessions-list and you will see the full status of all running VPN sessions, included if they are connected or not.

[linexc]

@dsommers I find it cannot be stopped after I press ctr -C.

[dsommers]

If the session was started using openvpn3 session-start, you need to stop the session using openvpn3 session-manage --disconnect

Please see the openvpn3-session-start, openvpn3-session-manage and openvpn3-sessions-list man pages.

[dsommers]

Okay, so you lose connection because the default gateway to your host is changed. Notice line 4 in the [LOG] OPTIONS: part. This is why. And this is the expected behavior when you change the default gateway.

You need to figure out what you want with your VPN connection - to route all the Internet traffic via the VPN connection? Or just some subnets? If you want to route everything, you need to add an explicit route ensuring the IP address (or range) you connect from is not routed via the VPN tunnel. If you know which IP subnets you want to route via the tunnel, then you can use a different approach by adding a few additional options to your VPN config, like pull-filter and route lines, where you filter out the redirect-gateway option and adds the routes you need.

That said, this configuration file does not behave like it is intended to be used on a headless server anywhere. It sounds more like a config expected to be used on local devices you have physical access to. Do ensure you're not violating any terms of service.

Since this is not a bug in OpenVPN 3 Linux, I will convert this issue into a discussion topic instead.