Mint 19 - VPN connection failure without root permissions

[wrealcon]

Hi

I have encountered following issue in Mint 19 (not present in Linux Mint 18).
I've downloaded ovpn files from my VPN provider and I wanted to add one of them via network manager. Unfortunately I can't connect.
It doesn't work when I do the same in command line:

Code: Select all

openvpn --config <ovpn file>

But when I try it with sudo:

Code: Select all

sudo openvpn --config <ovpn file>

then I can connect and everything is working as expected.

My question is now - am I not in some group or something like that so that I don't have permission to establish vpn connection?
Reinstallation of openvpn does not help.

[Faust]

.....
I have encountered following issue in Mint 19 (not present in Linux Mint 18).
.........

Did you get to Mint 19 by upgrading from 18.x ?

I did , and almost everything works sweetly , but I have a similar issue with VPN ( and I didn't need to be root before ) .

I don't want to spend much time chasing this down because 17.3 is still my " daily drive " , and everything works perfectly
.... I'd happily stay with it forever if that were a practical option

I'm hoping that someone less lazy than myself will post in this thread with a fix

[ugly]

I'm not sure if it's related, but I've found that I can't connect using v.81 of PIA.

If I enable IPV6 leak protection, and try to connect, PIA just gets stuck on 'Connecting'.

If I disable IPV6 leak protection, and try to connect, PIA will continually attempt to connect, connect for a second and then become disconnected, and Mint will display a notification that my wired connection has disconnected. This will repeat endlessly.

I've tested with an older version v.80 and it does the same thing. An even older version v.75 seems to connect (but has other non-connection issues).

[bettik]

I'm not sure if it's related, but I've found that I can't connect using v.81 of PIA.

If I enable IPV6 leak protection, and try to connect, PIA just gets stuck on 'Connecting'.

If I disable IPV6 leak protection, and try to connect, PIA will continually attempt to connect, connect for a second and then become disconnected, and Mint will display a notification that my wired connection has disconnected. This will repeat endlessly.

I've tested with an older version v.80 and it does the same thing. An even older version v.75 seems to connect (but has other non-connection issues).

Have you tried PIA's support via email. I had some issues with 18.3 but they were great in helping me get to the bottom of it and escalated to level 2 in short order when the initial trouble shooting attempts failed. It may take a day in between correspondence (probably due to time zones), but they stuck with it until I got it sorted out. Might be worth a try. Good luck ~Jim

[rewyllys]

@wrealcon,

Thanks for your post about the VPN failure in LM19. I also have encountered this problem, and am happy and grateful to be able to report that your workaround solved the problem for me.

Yes, it's a bit of nuisance, but it DOES work!

BTW, I notice that Clem has acknowledged the problem in his "Monthly News -- July 2018" (v. the 5th paragraph).

[greerd]

@ugly, I'm not sure why pia v8.1 doesn't work for you, it works fine on my Mint19 cinnamon as did earlier versions.

But there is an alternative gui that AirVPN forum member corrado wrote using python and PyQt that I've been using since its early development (May).

From github :

Qomui
Written in Python 3.6

Description
Qomui (Qt OpenVPN Management UI) is an easy-to-use OpenVPN Gui for GNU/Linux with some unique features such as provider-independent support for double-hop connections. Qomui supports multiple providers with added convenience when using AirVPN, PIA or Mullvad.

Features
should work with all VPN providers that offer OpenVPN config files
automatic download function for Mullvad, Private Internet Access and AirVPN
support for OpenVPN over SSL and SSH for AirVPN
allows double-hop VPN connections (VPN chains) between different providers (currently tested with AirVPN, Mullvad and ProtonVPN).
Gui written in PyQt including option to minimize application to system tray
security-conscious separation of the gui and a D-Bus service that handles commands that require root privileges
protection against DNS leaks/ipv6 leaks
iptables-based, configurable firewall that blocks all outgoing network traffic in case the VPN connection breaks down
allow applications to bypass the VPN tunnel - to watch Netflix for example
experimental support for Wireguard
command-line interface

Note that firejailing a browser cannot be bypassed from within the gui at this point in time but can be run from the cli, eg. to run chrome firejailedcgexec -g net_cls:bypass_qomui firejail /usr/bin/google-chrome-stable %U works good and allows you to stream netflix using chrome while everything else is run over the vpn.

Cheers

[rewyllys]

I neglected to mention in my previous post, I upgraded from 18.3. Also I installed KVM, and modified my /etc/network/interfaces to the code below, per the installation instructions. The VPN does work on a clean installation of Mint 19, without KVM. Are there other config files I should check?

Code: Select all

# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo br0
iface lo inet loopback

#added for KVM
iface enp0s31f6 inet manual
iface br0 inet dhcp
    bridge_ports enp0s31f6

[ugly]

@ugly, I'm not sure why pia v8.1 doesn't work for you, it works fine on my Mint19 cinnamon as did earlier versions.

But there is an alternative gui that AirVPN forum member corrado wrote using python and PyQt that I've been using since its early development (May).

From github :

Qomui
Written in Python 3.6

Description
Qomui (Qt OpenVPN Management UI) is an easy-to-use OpenVPN Gui for GNU/Linux with some unique features such as provider-independent support for double-hop connections. Qomui supports multiple providers with added convenience when using AirVPN, PIA or Mullvad.

Features
should work with all VPN providers that offer OpenVPN config files
automatic download function for Mullvad, Private Internet Access and AirVPN
support for OpenVPN over SSL and SSH for AirVPN
allows double-hop VPN connections (VPN chains) between different providers (currently tested with AirVPN, Mullvad and ProtonVPN).
Gui written in PyQt including option to minimize application to system tray
security-conscious separation of the gui and a D-Bus service that handles commands that require root privileges
protection against DNS leaks/ipv6 leaks
iptables-based, configurable firewall that blocks all outgoing network traffic in case the VPN connection breaks down
allow applications to bypass the VPN tunnel - to watch Netflix for example
experimental support for Wireguard
command-line interface

Note that firejailing a browser cannot be bypassed from within the gui at this point in time but can be run from the cli, eg. to run chrome firejailedcgexec -g net_cls:bypass_qomui firejail /usr/bin/google-chrome-stable %U works good and allows you to stream netflix using chrome while everything else is run over the vpn.

Cheers

Thanks for the recommendation, but I did find the solution.

I think the problem was because I keep my backup files (including some installers, like the one for PIA) on an NTFS drive. So I would run the installer from the NTFS drive. Running from an NTFS drive must have caused some issues with the install.

I tried the installer from the mounted NTFS drive on my current install of LM19, and then on a live disk to isolate anything I might have messed up and both times PIA installed, but then failed to connect.

Then I moved the installer to my /home folder and ran it, and it's been working fine.

For whatever reason, v75 worked when I ran the installer from the NTFS drive. But versions newer than v75 wouldn't work.

[lucid37]

Hi All,

I just wanted to add that I am also facing the same issue of not
being able to connect to a VPN (in my cas iPvanish) through the
Network Manager (Network Connections) since I installed
Mint 19. It was working flawlessly in 18.3 and I did a fresh install
of Mint 19.

I just tried to connect using 'sudo openvpn --config <config file>' and that worked fine.

Has anyone figured out a fix around this yet since I really dont want to be using the command
line everytime I want to connect to my VPN?

Thanks!

[pan0rama]

I just tried to connect using 'sudo openvpn --config <config file>' and that worked fine.
Has anyone figured out a fix around this yet since I really dont want to be using the command
line everytime I want to connect to my VPN?

I had the same problem. Also IP Vanish. I solved it by increasing the log level of the NetworkManager and looking at what was not working in the syslog:

Terminal:

Code: Select all

sudo NetworkManager --log-level=DEBUG

after that

Code: Select all

sudo tail -f /var/log/syslog

Then start the VPN connection in the NetworkManager and watch what is in the log file.
In my case:

Code: Select all

nm-openvpn[1957]: Options error: --ca fails with '/home/user/IPVanish%20config/ca.ipvanish.com.crt': No such file or directory (errno=2)
nm-openvpn[1957]: Options error: Please correct these errors.

I did copy all ipvanish config files into a new folder /home/user/.vpn/config/ (which I created myself before) within the home folder. After this, I delete the old VPN configurations I imported before in NetworkManager and import the .ovpn again. Now everything works as it should.

Don't forget to reset log level back to INFO later.

[Dream Sequencer]

I had a similar problem but in the end the solution was different.

First of all, thanks for the hint with the log level. That lead me to the (right?) conclusion:

My error message in the debug output was:

Options error: --ca fails with '/home/xyz/.cert/nm-openvpn/Germany%20-%20Frankfurt-ca.pem': No such file or directory (errno=2)

In that directory, the file was there but with spaces instead of the encodings(%20). After I renamed the spaces to %20 it worked.

Still, it seems to be a problem of the new Network Manager. In the NM dialog, the file is specified with spaces but then it encodes these to %20 and is trying to look for that, which, of course, fails.

[lucid37]

Thanks guys,
I really appreciate your answers. IT helped me fix my problem and now I can connect
perfectly.

In my case the problem was the configs folder which is: .../IPvanish%20configs/
So the space between the words were giving a problem. As soon as I just changed
it to .../IPvanish/ and added a connection again it worked pefectly.

Thanks again!

[tks234]

Thank you so much. This solved my problem.

I also had to change the name of my config files from Ipvanish configs to just configs. Everything seems to work as per the norm.