vasek

seprik_lo
which: no resolvconf in ((null))

$(which resolvconf) возвращает нуль, не понимает, лучше прописать полный путь

vasek

seprik_lo
which: no resolvconf in ((null))

$(which resolvconf) возвращает нуль, не понимает, лучше прописать полный путь

binaryshadow
Из конфига клиента попробуй выкинуть:
user nobody
group nobody

52th

Но происходит утечка DNS, а это меня не устраивает.

А на сервере, куда подключаетесь, настроен DNS-сервер?
Просто на моём сервере, куда я подключаюсь по OpenVPN, поднят DNS и я добавил в кофиг сервера строчку:

push "dhcp-option DNS 192.168.0.1"

И при подключении берётся DNS сервера, утечек не наблюдал

52th
А если без скрипта, запускается?

script-security 2
up /usr/share/openvpn/update-resolv-conf
down /usr/share/openvpn/update-resolv-conf

Fri Sep 28 14:01:31 2018 OpenVPN 2.4.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2018
Fri Sep 28 14:01:31 2018 library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.10
Fri Sep 28 14:01:31 2018 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Sep 28 14:01:31 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 28 14:01:31 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 28 14:01:31 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]80.211.28.6:1194
Fri Sep 28 14:01:31 2018 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Sep 28 14:01:31 2018 UDP link local: (not bound)
Fri Sep 28 14:01:31 2018 UDP link remote: [AF_INET]80.211.28.6:1194
Fri Sep 28 14:01:31 2018 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Fri Sep 28 14:01:31 2018 TLS: Initial packet from [AF_INET]80.211.28.6:1194, sid=798f5d1e 1be76321
Fri Sep 28 14:01:31 2018 VERIFY OK: depth=1, CN=Easy-RSA CA
Fri Sep 28 14:01:31 2018 VERIFY KU OK
Fri Sep 28 14:01:31 2018 Validating certificate extended key usage
Fri Sep 28 14:01:31 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Sep 28 14:01:31 2018 VERIFY EKU OK
Fri Sep 28 14:01:31 2018 VERIFY OK: depth=0, CN=uservpn
Fri Sep 28 14:01:31 2018 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Fri Sep 28 14:01:31 2018 [uservpn] Peer Connection Initiated with [AF_INET]80.211.28.6:1194
Fri Sep 28 14:01:32 2018 SENT CONTROL [uservpn]: 'PUSH_REQUEST' (status=1)
Fri Sep 28 14:01:32 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
Fri Sep 28 14:01:32 2018 OPTIONS IMPORT: timers and/or timeouts modified
Fri Sep 28 14:01:32 2018 OPTIONS IMPORT: --ifconfig/up options modified
Fri Sep 28 14:01:32 2018 OPTIONS IMPORT: route options modified
Fri Sep 28 14:01:32 2018 OPTIONS IMPORT: peer-id set
Fri Sep 28 14:01:32 2018 OPTIONS IMPORT: adjusting link_mtu to 1625
Fri Sep 28 14:01:32 2018 OPTIONS IMPORT: data channel crypto options modified
Fri Sep 28 14:01:32 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Fri Sep 28 14:01:32 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Sep 28 14:01:32 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Sep 28 14:01:32 2018 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlp3s0 HWADDR=24:fd:52:c2:7e:76
Fri Sep 28 14:01:32 2018 TUN/TAP device tun0 opened
Fri Sep 28 14:01:32 2018 TUN/TAP TX queue length set to 100
Fri Sep 28 14:01:32 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Sep 28 14:01:32 2018 /usr/bin/ip link set dev tun0 up mtu 1500
Fri Sep 28 14:01:32 2018 /usr/bin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Fri Sep 28 14:01:32 2018 /usr/share/openvpn/update-resolv-conf tun0 1500 1553 10.8.0.6 10.8.0.5 init
which: no resolvconf in ((null))
Fri Sep 28 14:01:32 2018 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Fri Sep 28 14:01:32 2018 Exiting due to fatal error

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/easyrsa3/pki/ca.crt
cert /etc/openvpn/easy-rsa/easyrsa3/pki/issued/uservpn.crt
key /etc/openvpn/easy-rsa/easyrsa3/pki/private/uservpn.key
dh /etc/openvpn/easy-rsa/easyrsa3/pki/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
remote-cert-tls client
tls-auth /etc/openvpn/server/ta.key 0 # This file is secret
cipher AES-256-CBC
comp-lzo
max-clients 5
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1

client
dev tun
proto udp
remote 80.211.28.6 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca /etc/openvpn/client/ca.crt
cert /etc/openvpn/client/userpc.crt
key /etc/openvpn/client/userpc.key
remote-cert-tls server
script-security 2
up /usr/share/openvpn/update-resolv-conf
down /usr/share/openvpn/update-resolv-conf
tls-auth /etc/openvpn/client/ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3

#!/bin/bash
set -e
RESOLVCONF=$(which resolvconf)
[ -x $RESOLVCONF ] || exit 0

case $script_type in

up)
   for optionname in ${!foreign_option_*} ; do
      option="${!optionname}"
      echo $option
      part1=$(echo "$option" | cut -d " " -f 1)
      if [ "$part1" == "dhcp-option" ] ; then
         part2=$(echo "$option" | cut -d " " -f 2)
         part3=$(echo "$option" | cut -d " " -f 3)
         if [ "$part2" == "DNS" ] ; then
            IF_DNS_NAMESERVERS="$IF_DNS_NAMESERVERS $part3"
         fi
         if [[ "$part2" == "DOMAIN" || "$part2" == "DOMAIN-SEARCH" ]] ; then
            IF_DNS_SEARCH="$IF_DNS_SEARCH $part3"
         fi
      fi
   done
   R=""
   for DS in $IF_DNS_SEARCH ; do
           R="${R}search $DS
"
   done
   for NS in $IF_DNS_NAMESERVERS ; do
           R="${R}nameserver $NS
"
   done
   #echo -n "$R" | $RESOLVCONF -p -a "${dev}"
   echo -n "$R" | $RESOLVCONF -a "${dev}.inet"
   ;;
down)
   $RESOLVCONF -d "${dev}.inet"
   ;;
esac