0

I'm currently configuring an OpenVPN client on an arm microprocessor running debian squeeze, however I'm running into problems.

As the below shows, /dev/net/tun exists:

debarm:~# whoami
root
debarm:~# cd /dev/net
debarm:/dev/net# ls -lah
total 0
drwxr-xr-x  2 root root      60 Jul 23 16:26 .
drwxr-xr-x 13 root root    3.7K Jul 23 16:27 ..
crw-rw-rw-  1 root root 10, 200 Jul 23 16:26 tun

But when I try to start OpenVPN it throws an error:

debarm:/dev/net# openvpn /root/2738.ovpn
Thu Jul 23 16:29:31 2015 OpenVPN 2.1.3 arm-unknown-linux-gnueabi [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jun  6 2013
Thu Jul 23 16:29:31 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Jul 23 16:29:31 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Jul 23 16:29:31 2015 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
Thu Jul 23 16:29:36 2015 LZO compression initialized
Thu Jul 23 16:29:36 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Jul 23 16:29:36 2015 Socket Buffers: R=[112640->131072] S=[112640->131072]
Thu Jul 23 16:29:36 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Jul 23 16:29:36 2015 Local Options hash (VER=V4): '41690919'
Thu Jul 23 16:29:36 2015 Expected Remote Options hash (VER=V4): '530fdded'
Thu Jul 23 16:29:36 2015 UDPv4 link local: [undef]
Thu Jul 23 16:29:36 2015 UDPv4 link remote: [AF_INET]82.165.45.40:1194
Thu Jul 23 16:29:36 2015 TLS: Initial packet from [AF_INET]82.165.45.40:1194, sid=7151f8a2 4b0e9dab
Thu Jul 23 16:29:37 2015 VERIFY OK: depth=1, /C=GB/ST=London/L=London/O=xxxxx/OU=server/CN=xxxxx/name=server/emailAddress=xxxxxk
Thu Jul 23 16:29:37 2015 VERIFY OK: depth=0, /C=GB/ST=London/L=London/O=xxxxx/OU=server/CN=server/name=server/emailAddress=xxxxx
Thu Jul 23 16:29:39 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with  128 bit key
Thu Jul 23 16:29:39 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jul 23 16:29:39 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jul 23 16:29:39 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jul 23 16:29:39 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Jul 23 16:29:39 2015 [server] Peer Connection Initiated with [AF_INET]82.165.45.40:1194
Thu Jul 23 16:29:42 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Jul 23 16:29:42 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13'
Thu Jul 23 16:29:42 2015 OPTIONS IMPORT: timers and/or timeouts modified
Thu Jul 23 16:29:42 2015 OPTIONS IMPORT: --ifconfig/up options modified
Thu Jul 23 16:29:42 2015 OPTIONS IMPORT: route options modified
Thu Jul 23 16:29:42 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Jul 23 16:29:42 2015 ROUTE default_gateway=192.168.100.1
Thu Jul 23 16:29:42 2015 Note: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)
Thu Jul 23 16:29:42 2015 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
Thu Jul 23 16:29:42 2015 Cannot allocate TUN/TAP dev dynamically
Thu Jul 23 16:29:42 2015 Exiting

Equally, if I try to modprobe it, I get an error, however I think that's to do with the fact tun is now compiled in rather than a kernal module

debarm:/dev/net# modprobe tun
FATAL: Module tun not found.

Could someone hopefully suggest a reason why this might be the case, and ideally a solution! :-)

Thanks!

1 Answer 1

0

Existence of file: /dev/net/tun (character device) is not equal to existence of kernel module called 'tun'.

Solution: add tun device to kernel configuration and recompile the kernel.

Check current module state: lsmod | grep tun.

2
  • Yup, that pretty much sums it up. Unfortunately the kernel provided with the board (FoxBoard G20 for anyone who wants to know) doesn't come with the tun kernel module. A kernel recompile for all 40 boards was out of the question so we've made do with reverse tunnels for now. Jul 30, 2015 at 1:06
  • You don't need to do kernel recompilation on all devices, you need to do it on one of them and then copy necessary changes: - kernel, initrd (if exist) and modules to others. Sep 12, 2015 at 10:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .