|
 |
d10d8ef |
OpenVPN and systemd
|
|
|
d10d8ef |
===================
|
|
|
d10d8ef |
|
|
|
d10d8ef |
As of OpenVPN v2.4, upstream is shipping systemd unit files to provide a
|
|
|
d10d8ef |
fine grained control of each OpenVPN configuration as well as trying to
|
|
|
d10d8ef |
restrict the capabilities the OpenVPN process have on a system.
|
|
|
d10d8ef |
|
|
|
d10d8ef |
|
|
|
d10d8ef |
Configuration profile types
|
|
|
d10d8ef |
---------------------------
|
|
|
d10d8ef |
These new unit files separates between client and server profiles. The
|
|
|
d10d8ef |
configuration files are kept in separate directories, to provide clarity
|
|
|
d10d8ef |
of the profile they run under.
|
|
|
d10d8ef |
|
|
|
d10d8ef |
Typically the client profile cannot bind to any ports below port 1024
|
|
|
d10d8ef |
and the client configuration is always started with --nobind.
|
|
|
d10d8ef |
|
|
|
d10d8ef |
The server profile is allowed to bind to any ports. In addition it enables
|
|
|
d10d8ef |
a client status file, usually found in the /run/openvpn-server directory.
|
|
|
d10d8ef |
The status format is set to version 2 by default. These settings may be
|
|
|
d10d8ef |
overridden by adding --status and/or --status-version in the OpenVPN
|
|
|
d10d8ef |
configuration file.
|
|
|
d10d8ef |
|
|
|
d10d8ef |
Neither of these profiles makes use of PID files, but OpenVPN reports back to
|
|
|
d10d8ef |
systemd its PID once it has initialized.
|
|
|
d10d8ef |
|
|
|
d10d8ef |
For configuration using a peer-to-peer mode (not using --mode server on one
|
|
|
d10d8ef |
of the sides) it is recommended to use the client profile.
|
|
|
d10d8ef |
|
|
|
d10d8ef |
|
|
|
d10d8ef |
Configuration files
|
|
|
d10d8ef |
-------------------
|
|
|
d10d8ef |
These new unit files expects client configuration files to be made available
|
|
|
d10d8ef |
in /etc/openvpn/client. Similar for the server configurations, it is expected
|
|
|
d10d8ef |
to be found in /etc/openvpn/server. The configuration files must have a .conf
|
|
|
d10d8ef |
file extension.
|
|
|
d10d8ef |
|
|
|
d10d8ef |
|
|
|
d10d8ef |
Managing VPN tunnels
|
|
|
d10d8ef |
--------------------
|
|
|
d10d8ef |
Use the normal systemctl tool to start, stop VPN tunnels, as well as enable
|
|
|
d10d8ef |
and disable tunnels at boot time. The syntax is:
|
|
|
d10d8ef |
|
|
|
d10d8ef |
- client configurations:
|
|
|
d10d8ef |
# systemctl $OPER openvpn-client@$CONFIGNAME
|
|
|
d10d8ef |
|
|
|
d10d8ef |
- server configurations:
|
|
|
d10d8ef |
# systemctl $OPER openvpn-server@$CONFIGNAME
|
|
|
d10d8ef |
|
|
|
d10d8ef |
Similarly, to view the OpenVPN journal log use a similar syntax:
|
|
|
d10d8ef |
|
|
|
d10d8ef |
# journalctl -u openvpn-client@$CONFIGNAME
|
|
|
d10d8ef |
or
|
|
|
d10d8ef |
# journalctl -u openvpn-server@$CONFIGNAME
|
|
|
d10d8ef |
|
|
|
d10d8ef |
* Examples
|
|
|
d10d8ef |
Say your server configuration is /etc/openvpn/server/tun0.conf, you
|
|
|
d10d8ef |
start this VPN service like this:
|
|
|
d10d8ef |
|
|
|
d10d8ef |
# systemctl start openvpn-server@tun0
|
|
|
d10d8ef |
|
|
|
d10d8ef |
A client configuration file in /etc/openvpn/client/corpvpn.conf is
|
|
|
d10d8ef |
started like this:
|
|
|
d10d8ef |
|
|
|
d10d8ef |
# systemctl start openvpn-client@corpvpn
|
|
|
d10d8ef |
|
|
|
d10d8ef |
To view the server configuration's journal only listing entries from
|
|
|
d10d8ef |
yesterday and until today:
|
|
|
d10d8ef |
|
|
|
d10d8ef |
# journalctl --since yesterday -u openvpn-server@tun0
|
|
|
d10d8ef |
|