Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having trouble setting up OpenVPN on my server running CentOS 6.2. I have used OpenVPN on this server before and it worked (although that was with Ubuntu, now I'm using CentOS). I just reformatted the hard drive and am trying to get OpenVPN up and running again. I use the up and down directives in my OpenVPN config file to setup my bridge. For some reason when the up script runs, I get a permission denied error when trying to execute brctl. Here's my config file:

mode server

local ##ip of server
port 1194
proto tcp

dev tap0
up "/etc/openvpn/ br0"
down "/etc/openvpn/ br0"


ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
#tls-auth ta.key 0

cipher BF-CBC

ifconfig-pool-persist ipp.txt
push "dhcp-option DNS"
push "dhcp-option DOMAIN"
max-clients 10

user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3

And here's the script:


/sbin/ifconfig $DEV mtu $MTU promisc up
/usr/sbin/brctl addif $BR $DEV

brctl works fine outside of this script. I'm able to execute it manually.

I start OpenVPN as root, so I don't think permissions in the issue, so that's why I'm so confused.

Thanks for any help.

EDIT: Here's the error that's echoed:

[root@server openvpn]# /etc/init.d/openvpn start Starting openvpn: /etc/openvpn/ line 7: /usr/sbin/brctl: Permission denied [FAILED]

share|improve this question
Is there anything in /var/log/messages or audit? Checked selinux? – Bart De Vos Jun 4 '12 at 23:07
This is logged in messages: WARNING: Failed running command (--up/--down): external program exited with error status: 126 – edc1591 Jun 4 '12 at 23:09
Nothing in audit. And what do you mean by "checked selinux? – edc1591 Jun 4 '12 at 23:10
Error 126 is "not executable". Have you chmod +xed the script? – SmallClanger Jun 5 '12 at 9:28
Yup, same problem. I also realized I forgot to post the error. I've edited my post. – edc1591 Jun 5 '12 at 23:07
up vote 1 down vote accepted

I believe you hit this bug.

Create file openvpnlocal.te:

module openvpnlocal 1.0;
require {
    type openvpn_t;
    type brctl_exec_t;
    class file { read execute open execute_no_trans };
#============= openvpn_t ==============
allow openvpn_t brctl_exec_t:file { read execute open execute_no_trans };

Then run:

checkmodule -M -m -o openvpnlocal.mod openvpnlocal.te
semodule_package -o openvpnlocal.pp -m openvpnlocal.mod
semodule -i openvpnlocal.pp
share|improve this answer
That worked! Thanks! – edc1591 Jun 6 '12 at 23:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.