connecting to OpenVPN server: why NetworkManager nm-openvpn
gererates curious, pointless random hostnames?
by Franta Hanzlík
I'm trying to configure OpenVPN connection in Fedora 37 NetworkManager.
The configuration was created by importing the .ovpn file and subsequent
its result correction. But connection is not working, and it seems it
is because MetwokManage/nm-openvpn prepend OpenVPN server name with
random string - which, of course, isn't resolvable to IP (v4) address.
My configuration file is:
# cat /etc/NetworkManager/system-connections/lada.nmconnection
[connection]
id=mojevpn
uuid=523155d8-ce42-499f-9b65-371733cd420c
type=vpn
autoconnect=false
[vpn]
ca=/etc/pki/vpnky/mojevpn/mojevpn-ca.pem
cert=/etc/pki/vpnky/mojevpn/mojevpn-cert.pem
cert-pass-flags=4
cipher=AES-128-GCM
connection-type=password-tls
dev=tun
dev-type=tun
key=/etc/pki/vpnky/mojevpn/mojevpn-key.pem
password-flags=2
remote=gw.mujsrv.org
remote-cert-tls=server
remote-random-hostname=yes
ta=/etc/pki/vpnky/mojevpn/mojevpn-tls-auth.pem
ta-dir=0
username=lada
service-type=org.freedesktop.NetworkManager.openvpn
[ipv4]
method=auto
[ipv6]
addr-gen-mode=stable-privacy
method=disabled
[proxy]
# nmcli connection up --ask mojevpn
You need to authenticate to access the Virtual Private Network “mojevpn”.
Password (vpn.secrets.password): ••••••••••
Error: Connection activation failed: The connection attempt timed out
And what is listen with tcpdump and in syslog:
# tcpdump -i any -B 64000 -nn port 53 or port 1194
20:27:55.403571 enp4s0 Out IP 172.31.48.127.44308 > 172.31.48.254.53: 3278+ [1au] A? 7cf36e0b3a88.gw.mujsrv.org. (53)
20:27:55.403711 enp4s0 Out IP 172.31.48.127.36822 > 172.31.48.254.53: 58603+ [1au] AAAA? 7cf36e0b3a88.gw.mujsrv.org. (53)
20:27:55.545573 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.36822: 58603 NXDomain 0/1/1 (138)
20:27:55.545752 enp4s0 Out IP 172.31.48.127.36822 > 172.31.48.254.53: 58603+ AAAA? 7cf36e0b3a88.gw.mujsrv.org. (42)
20:27:55.546081 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.36822: 58603 NXDomain 0/1/0 (127)
20:27:55.548708 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.44308: 3278 NXDomain 0/1/1 (138)
20:27:55.549710 enp4s0 Out IP 172.31.48.127.60509 > 172.31.48.254.53: 41153+ [1au] A? bd30780f6ca9.gw.mujsrv.org. (53)
20:27:55.549819 enp4s0 Out IP 172.31.48.127.35849 > 172.31.48.254.53: 43141+ [1au] AAAA? bd30780f6ca9.gw.mujsrv.org. (53)
20:27:55.610201 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.60509: 41153 NXDomain 0/1/1 (138)
20:27:55.610256 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.35849: 43141 NXDomain 0/1/1 (138)
20:27:55.610349 enp4s0 Out IP 172.31.48.127.60509 > 172.31.48.254.53: 41153+ A? bd30780f6ca9.gw.mujsrv.org. (42)
20:27:55.610427 enp4s0 Out IP 172.31.48.127.35849 > 172.31.48.254.53: 43141+ AAAA? bd30780f6ca9.gw.mujsrv.org. (42)
20:27:55.610635 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.60509: 41153 NXDomain 0/1/0 (127)
20:27:55.610677 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.35849: 43141 NXDomain 0/1/0 (127)
20:28:15.631685 enp4s0 Out IP 172.31.48.127.46400 > 172.31.48.254.53: 33469+ [1au] A? 041d1d870348.gw.mujsrv.org. (53)
20:28:15.631799 enp4s0 Out IP 172.31.48.127.38725 > 172.31.48.254.53: 21530+ [1au] AAAA? 041d1d870348.gw.mujsrv.org. (53)
20:28:15.776090 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.46400: 33469 NXDomain 0/1/1 (138)
20:28:15.776145 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.38725: 21530 NXDomain 0/1/1 (138)
20:28:15.776247 enp4s0 Out IP 172.31.48.127.46400 > 172.31.48.254.53: 33469+ A? 041d1d870348.gw.mujsrv.org. (42)
20:28:15.776330 enp4s0 Out IP 172.31.48.127.38725 > 172.31.48.254.53: 21530+ AAAA? 041d1d870348.gw.mujsrv.org. (42)
20:28:15.776663 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.46400: 33469 NXDomain 0/1/0 (127)
20:28:15.776711 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.38725: 21530 NXDomain 0/1/0 (127)
20:28:15.777705 enp4s0 Out IP 172.31.48.127.40721 > 172.31.48.254.53: 22744+ [1au] A? 3f9917dadb55.gw.mujsrv.org. (53)
20:28:15.777813 enp4s0 Out IP 172.31.48.127.57177 > 172.31.48.254.53: 3045+ [1au] AAAA? 3f9917dadb55.gw.mujsrv.org. (53)
20:28:15.817539 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.57177: 3045 NXDomain 0/1/1 (138)
20:28:15.817593 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.40721: 22744 NXDomain 0/1/1 (138)
20:28:15.817716 enp4s0 Out IP 172.31.48.127.57177 > 172.31.48.254.53: 3045+ AAAA? 3f9917dadb55.gw.mujsrv.org. (42)
20:28:15.817797 enp4s0 Out IP 172.31.48.127.40721 > 172.31.48.254.53: 22744+ A? 3f9917dadb55.gw.mujsrv.org. (42)
20:28:15.817997 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.57177: 3045 NXDomain 0/1/0 (127)
20:28:15.818074 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.40721: 22744 NXDomain 0/1/0 (127)
....
# tail -f /var/log/messages
Apr 16 20:27:55 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: 7cf36e0b3a88.gw.mujsrv.org:1194 (Name or service not known)
Apr 16 20:27:55 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: bd30780f6ca9.gw.mujsrv.org:1194 (Name or service not known)
Apr 16 20:27:55 pc-jana nm-openvpn[786758]: Could not determine IPv4/IPv6 protocol
Apr 16 20:27:55 pc-jana nm-openvpn[786758]: SIGUSR1[soft,init_instance] received, process restarting
Apr 16 20:28:15 pc-jana nm-openvpn[786758]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 16 20:28:15 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: 041d1d870348.gw.mujsrv.org:1194 (Name or service not known)
Apr 16 20:28:15 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: 3f9917dadb55.gw.mujsrv.org:1194 (Name or service not known)
Apr 16 20:28:15 pc-jana nm-openvpn[786758]: Could not determine IPv4/IPv6 protocol
Apr 16 20:28:15 pc-jana nm-openvpn[786758]: SIGUSR1[soft,init_instance] received, process restarting
Apr 16 20:28:24 pc-jana nm-openvpn[786758]: SIGTERM[hard,init_instance] received, process exiting
...
From above, NM tries DNS result not for 'gw.mujsrv.org' host, but for
some insane 7cf36e0b3a88.gw.mujsrv.org / bd30780f6ca9.gw.mujsrv.org /
041d1d870348.gw.mujsrv.org / 3f9917dadb55.gw.mujsrv.org /...
Can anyone see where the problem might be?
And one more, perhaps not a very important little thing: is it possible
to tell the NM to do only IPv4 resolution of the vpn server name (it
does not have an IPv6 address)?
---
Thanks in advance, Franta Hanzlik
1 year, 1 month
Broken by the grub startup after have move whole the system from one
SSHDD more small to a SSD more big by a software acronis
by Dorian ROSSE
Hello everybody,
Broken by the grub startup after have move whole the system from one SSHDD more small to a SSD more big by a software acronis thus I want have the path for repair this problem naturally the path is your help although the program by acronis was work without problems maybe the problems is a threat because I was use the version trial of one program acronis who remove the threat that is why this program for worker in IT is my favourite for backup problem or for repair a setup so thanks you in advance to bring your help too have a good week,
Regards.
Dorian Rosse.
1 year, 1 month
Running VirtualBox Crashes Other Apps
by Jonathan Ryshpan
Starting Oracle's VirtualBox has started to crash other apps, in
particular Thunderbird, Firefox, and Libreoffice; but not the console.
Firefox and Thunderbird just stop; Libreoffice attempts to restore files
being worked on (but it failed to restore about 2 hours' worth of work).
Has anyone seen anything like this? Any ideas on how to prevent it? Any
experience with other virtual environments?
System info:
Operating System: Fedora Linux 37
KDE Plasma Version: 5.27.4
KDE Frameworks Version: 5.104.0
Qt Version: 5.15.8
Kernel Version: 6.2.9-200.fc37.x86_64 (64-bit)
Graphics Platform: X11
Processors: 8 × Intel® Core™ i7-4790K CPU @ 4.00GHz
Memory: 15.5 GiB of RAM
Graphics Processor: Mesa Intel® HD Graphics 4600
Manufacturer: ASUS
Product Name: All Series
--
Sincerely Jonathan Ryshpan <jonrysh(a)pacbell.net>
They know that it is human nature to take up
causes whereby a man may oppress his neighbor,
no matter how unjustly. ... Hence they have had
no trouble in finding men who would preach the
damnability and heresy of the new doctrine from
the very pulpit... -- Galileo Galilei, 1615
1 year, 1 month
USBGuard integration next to encryption?
by Hoppár Zoltán
Hi,
I think it would be an interesting option to have USBGuard integrated as part of the Workstation, and have "hardening" option to the kernel too at install together with encryption?
1 year, 1 month
Cockpit as root
by Emmett Culley
I am not able to login to cockpit, localhost:9090, as root. I can login as a normal user, but that isn't acceptable. Why would I even need cockpit as a normal user?
I have a fully updated Fedora instance. It may be related somehow to plasma as at the top of the login dialog I see "Fedora Linux KDE Plasma".
I suppose there is a configuration option to allow root logins. Note that sudo is not an option I am interested in using.
Emmett
1 year, 1 month
what is my dns?
by ToddAndMargo
Hi All,
Fedora 37
I have a caching server running. Other than digging
out my "forward" from /etc/named.conf to figure out
what my DNS server is, is there a way to use "dig"
or other to figure out what my actual DNS server is?
Many thanks,
-T
1 year, 1 month
Re: Running VirtualBox Crashes Other Apps
by C. Linus Hicks
Subject: Running VirtualBox Crashes Other Apps
Starting Oracle's VirtualBox has started to crash other apps, in particular Thunderbird, Firefox, and Libreoffice; but not the console. Firefox and Thunderbird just stop; Libreoffice attempts to restore files being worked on (but it failed to restore about 2 hours' worth of work).
Has anyone seen anything like this? Any ideas on how to prevent it? Any experience with other virtual environments?
System info:
Operating System: Fedora Linux 37
KDE Plasma Version: 5.27.4
KDE Frameworks Version: 5.104.0
Qt Version: 5.15.8
Kernel Version: 6.2.9-200.fc37.x86_64 (64-bit)
Graphics Platform: X11
Processors: 8 × Intel® Core™ i7-4790K CPU @ 4.00GHz
Memory: 15.5 GiB of RAM
Graphics Processor: Mesa Intel® HD Graphics 4600
Manufacturer: ASUS
Product Name: All Series
You didn't report what version of VirtualBox you are running.
1 year, 1 month
Alternative to VLC
by ToddAndMargo
Hi All,
VLC can play a lot of stuff, but the player
has so, so many bugs in it that I am thinking
it is time to give up on VLC. Parole seems to
work okay.
You guys have a favorite sub for VLC?
Many thanks,
-T
1 year, 1 month
How do I do a group reinstall of Xfce?
by ToddAndMargo
Hi All,
I have both MATE and Xfce installed. If I boot
into MATE, such that Xfce is not running, or not
start a GUI at all, how do I do a group reinstall
of Xfce?
Many thanks,
-T
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computers are like air conditioners.
They malfunction when you open windows
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 year, 1 month
Warning for KDE users with HiDPI displays
by Go Canes
I "dnf updated" today and it took my system to KDE Plasma 5.27.1, and
there is an issue with scaling on HiDPI displays. As near as I can
tell the issue isn't fixed until 5.27.4, but that is not yet available
in updates-testing. There are workarounds, but so far my experience
is they make the system usable, but not "right".
1 year, 1 month
