Hello, I'm trying to get vpn connection managed by connman. I've been looking in the documentation in the sources or website, but didn't find my answer yet. So far, I can connect to my OpenVPN server manually via connmanctl, so I guess my vpn config file is quite ok. But the remaining question is about the autoconnection and link verification. From my understanding autoconnect, reconnect etc, that we can configure in main config file only applies to technologies, but VPNs are not technologies from connman perspectives, so they are listed as service (maybe my statement here is not correct ?).

My goal is to be able, as soon as I get proper network connection, either by ethernet, cellular or wifi technologies to get connected to my vpn server and in case of disconnection (so implicitly a connection check is done in background) to get reconnected.

* How to setup autoconnect and reconnect with OpenVPN (also in case we change technology from ethernet to cellular for instance) ?

* Regarding routes, I would like to know how to apply the routes pushed by the OpenVPN server as the default route?

* Regarding DNS server, I also would like to know how to get the DNS pushed by the OpenVPN applied in resolv.conf ?

Hi Daniel, Thanks for your feedback. Sorry for the delay but I was fully focused on something else recently. See my comments inline. Thanks, Florent. On 01/01/2017 15:39, Daniel Wagner wrote: > Hi Florent, > > On 12/27/2016 06:52 PM, Florent Le Saout wrote: >> Hello, >> >> I'm trying to get vpn connection managed by connman. >> >> I've been looking in the documentation in the sources or website, but >> didn't find my answer yet. >> >> So far, I can connect to my OpenVPN server manually via connmanctl, >> so I >> guess my vpn config file is quite ok. >> >> But the remaining question is about the autoconnection and link >> verification. >> >> From my understanding autoconnect, reconnect etc, that we can configure >> in main config file only applies to technologies, but VPNs are not >> technologies from connman perspectives, so they are listed as service >> (maybe my statement here is not correct ?). > > If you set your Ethernet Service and VPN Service to autoconnect, the > VPN tunnel will be openened after the Ethernet Service got connected. Regarding Ethernet, i see clearly that I can set it here "DefaultAutoConnectTechnologies = " in the main.conf, which is properly set as default. But this is only valid regarding technologies, and VPN is not a technology but a service, so it's not possible to set it here. So could you tell me if my assumptions are correct and how to set AutoConnect and autoreconnect for VPN ? > > >> My goal is to be able, as soon as I get proper network connection, >> either by ethernet, cellular or wifi technologies to get connected >> to my >> vpn server and in case of disconnection (so implicitly a connection >> check is done in background) to get reconnected. > > That should work in theory :) It seems it's properly managed but I have to test a bit more. > >> * How to setup autoconnect and reconnect with OpenVPN (also in >> case we >> change technology from ethernet to cellular for instance) ? > > ConnMan will reconnect the tunnel when the underlying connection dies > and there is a new connection established. Let say for a weird reason that my tunnel is not working anymore but the underling connection is still ok, then nothing will do a check inside excepted OpenVPN client itself ? There is nothing inside connman which will detect loss of connection of the tunnel itself even if the underlying connection is still valid? > >> * Regarding routes, I would like to know how to apply the routes >> pushed by the OpenVPN server as the default route? > > ConnMan will add the routes automatically to your routing table. You > just need to push them from the server, e.g. do something like > > push "redirect-gateway def1" I have that in my server config (I was about to add it to my original question) : * push "redirect-gateway def1 bypass-dhcp" When I do run OpenVPN manually, I get the route properly setup with my tunnel as default route, but with connman it's not the case anymore. Destination Gateway Genmask Flags Metric Ref Use Iface default 10.8.0.1 128.0.0.0 UG 0 0 0 tun0 I get those debug messages : connman-vpnd[1099]: vpn0 {update} flags 102609 <UP,RUNNING,LOWER_UP> connmand[1095]: vpn0 {update} flags 102609 <UP,RUNNING,LOWER_UP> connmand[1095]: vpn0 {newlink} index 12 address 00:00:00:00:00:00 mtu 1500 connmand[1095]: vpn0 {newlink} index 12 operstate 6 <UP> connman-vpnd[1099]: vpn0 {newlink} index 12 operstate 6 <UP> connmand[1095]: vpn0 {add} address 10.8.0.18/32 label vpn0 family 2 connmand[1095]: Adding host route failed (Network is unreachable) connmand[1095]: rp_filter set to 2 (loose mode routing), old value was 0 Connected vpn_Test_com connmanctl> connmand[1095]: ipconfig state 4 ipconfig method 1 connmand[1095]: vpn0 {add} route 10.8.0.1 gw 0.0.0.0 scope 253 <LINK> connmand[1095]: eth0 {add} route 149.202.178.61 gw 192.168.4.4 scope 0 <UNIVERSE> connmand[1095]: eth0 {del} route 0.0.0.0 gw 192.168.4.4 scope 0 <UNIVERSE> connmand[1095]: eth0 {add} route 0.0.0.0 gw 192.168.4.4 scope 0 <UNIVERSE> And for some reason, since I've added this line "Networks=192.168.1.0/255.255.255.0/10.8.0.1" in my openvpn config file for connman, it works almost all the time. It seems that when connman services are listed this way : # connmanctl services * R Test VPN vpn_Test_com *AO Wired ethernet_7076ff01000c_cable My routing table is as expected : # route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default * 0.0.0.0 U 0 0 0 vpn0 10.8.0.1 * 255.255.255.255 UH 0 0 0 vpn0 192.168.4.0 * 255.255.254.0 U 0 0 0 eth0 192.168.4.4 * 255.255.255.255 UH 0 0 0 eth0 192.168.4.201 192.168.4.4 255.255.255.255 UGH 0 0 0 eth0 But when connman services are listed this way : # connmanctl services *AO Wired ethernet_7076ff01000c_cable * R Test VPN vpn_Test_com My routing table is not as expected : # route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.4.4 0.0.0.0 UG 0 0 0 eth0 10.8.0.1 * 255.255.255.255 UH 0 0 0 vpn0 192.168.4.0 * 255.255.254.0 U 0 0 0 eth0 192.168.4.4 * 255.255.255.255 UH 0 0 0 eth0 192.168.4.201 192.168.4.4 255.255.255.255 UGH 0 0 0 eth0 Do you think that the order of the services has any impact on the default routing interface ? >> * Regarding DNS server, I also would like to know how to get the DNS >> pushed by the OpenVPN applied in resolv.conf ? > > Same here ConnMan will take of the DNS resolving, you might need to push > the right DNS entries from the OpenVPN server: > > push "dhcp-option DNS 85.25.128.10" > push "dhcp-option DNS 85.25.255.10" This part is working properly, when I do a connmanctl services vpn_.... I get : Nameservers = [ 10.8.0.1 ] But I have still a question. If Ethernet and Openvpn are providing DNS server, which one is selected first ? > > HTH, > > Thanks, > Daniel -- *Florent LE SAOUT* R&D department Embedded Software Developer AUSY contractor for KERLINK

Thanks for spending some time trying reproducing that. :) I'm actually on 2.3.14 on both side, compiled for ARM for the client and x86_64 for the server. I could not migrate so far on 2.4

* _Regarding routes :_ What I observe is that most of the times routes are properly set and connman is listing services in the right order : root # connmanctl services * R VPN vpn_192_168_4_201_test *AO Wired ethernet_7076ff010e20_cable # ip route default dev vpn0 10.8.0.1 dev vpn0 192.168.4.0/23 dev eth0 src 192.168.4.119 192.168.4.4 dev eth0 192.168.4.201 via 192.168.4.4 dev eth0 But once in a while, it's not correct. How can we make sure that VPN will always be on top of the others, which is the default expected behavior from my perspectives ?

I will also try to reproduce it on my side and try to provide you with as much details as I can. * _Regarding Autoconnect :_ When you say : The VPN Service itself has an AutoConnect property which tells ConnMan to start it automatically. Do you mean that this is set automatically by default for this type of service, or do I need to set it manually bu setting an option, because if this is the case I haven't found it ? See below the actual details of my connexion :

/net/connman/service/vpn_192_168_4_201_test Type = vpn Security = [ ] State = ready Favorite = True Immutable = False AutoConnect = False

I think I figured out the reproducing method. When I get the first connection, (so before the local settings file exist : vpn_X_X_X_X/settings) the route is always wrong. But at the second boot when the file is already there the route is properly setup. Please find attached the logs with proper and incorrect route setup. I guess it's trying to set the default route to the kernel before the vpn tunnel is actually ready ? Let me know if there is other points I should check or if I should add more logs.