VyOS 1.4rc3 - OpenVPN - where are openvpn-option defined in client config

General questions
1

Hi All,

I have an openvpn tunnel working with a couple warnings. In further investigation I noticed that some of the options don’t seem to be working. Where are the additional options added?

I get the following warning, yes only warning, but I wanted to understand how config is applied.

WARNING: Ignoring option 'dh' in tls-client mode, please only include this in your server configuration

WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for vtun5, therefore the route installation may fail or may not work as expected.

So I added these rules to tackle the IPv6 warning, but nothing happens.

set interfaces openvpn vtun5 openvpn-option 'pull-filter reject ifconfig-ipv6'
set interfaces openvpn vtun5 openvpn-option 'pull-filter reject ipv6-route'
set interfaces openvpn vtun5 openvpn-option '--block-ipv6'

I then found the configuration file under /run/openvpn/vtun5.conf and it is missing any options I have set. So were are they?

Some of the other options I set which are not visible in the client config.

set interfaces openvpn vtun5 openvpn-option 'remote-cert-tls server'
set interfaces openvpn vtun5 openvpn-option 'pull-filter ignore redirect-gateway'

I also found the “dh” value specified as none, which is causing the first warning, how does one remove this?

### Autogenerated by interfaces_openvpn.py ###
#
# See https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
# for individual keyword definition
#
# OpenVPN
#

verb 3
dev-type tun
dev vtun5
persist-key
proto udp
rport 1197
remote au.vpn.network
persist-tun
disable-dco

#
# OpenVPN Client mode
#
client
nobind


# TLS options
ca /run/openvpn/vtun5_ca.pem
dh none


# Encryption options
cipher AES-256-CBC
# https://vyos.dev/T5027
# Required to support BF-CBC (default ciphername when none given)
providers legacy default

auth sha256

auth-user-pass /run/openvpn/vtun5.pw
auth-retry nointeract

Regards

2

If i remember correctly, custom options are appended to the command line instead of the config.

3

Sarthurdev,

You wouldn’t happen to know how I can check what is being placed into this command line so I can debug it?

Thank you

4

ps aux | grep openvpn should show the command line.

5

Thank you - didn’t think of that :+1:

6

Ok so I managed to get rid of the second warning

WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for vtun5, therefore the route installation may fail or may not work as expected.

With a single openvpn-option

set interfaces openvpn vtun5 openvpn-option 'pull-filter ignore ipv6-route'

However for the first warning, it looks like /usr/libexec/vyos/conf_mode/interfaces_openvpn.py script is adding the dh none value even though it’s set as client mode.

WARNING: Ignoring option 'dh' in tls-client mode, please only include this in your server configuration

If I comment out dh none line from /run/openvpn/vtun5.conf and reload the interface all warnings are gone, until I recommit something on vtun5.

Regards