I'm trying to configure OpenVPN connection in Fedora 37 NetworkManager. The configuration was created by importing the .ovpn file and subsequent its result correction. But connection is not working, and it seems it is because MetwokManage/nm-openvpn prepend OpenVPN server name with random string - which, of course, isn't resolvable to IP (v4) address. My configuration file is: # cat /etc/NetworkManager/system-connections/lada.nmconnection [connection] id=mojevpn uuid=523155d8-ce42-499f-9b65-371733cd420c type=vpn autoconnect=false [vpn] ca=/etc/pki/vpnky/mojevpn/mojevpn-ca.pem cert=/etc/pki/vpnky/mojevpn/mojevpn-cert.pem cert-pass-flags=4 cipher=AES-128-GCM connection-type=password-tls dev=tun dev-type=tun key=/etc/pki/vpnky/mojevpn/mojevpn-key.pem password-flags=2 remote=gw.mujsrv.org remote-cert-tls=server remote-random-hostname=yes ta=/etc/pki/vpnky/mojevpn/mojevpn-tls-auth.pem ta-dir=0 username=lada service-type=org.freedesktop.NetworkManager.openvpn [ipv4] method=auto [ipv6] addr-gen-mode=stable-privacy method=disabled [proxy] # nmcli connection up --ask mojevpn You need to authenticate to access the Virtual Private Network “mojevpn”. Password (vpn.secrets.password): •••••••••• Error: Connection activation failed: The connection attempt timed out And what is listen with tcpdump and in syslog: # tcpdump -i any -B 64000 -nn port 53 or port 1194 20:27:55.403571 enp4s0 Out IP 172.31.48.127.44308 > 172.31.48.254.53: 3278+ [1au] A? 7cf36e0b3a88.gw.mujsrv.org. (53) 20:27:55.403711 enp4s0 Out IP 172.31.48.127.36822 > 172.31.48.254.53: 58603+ [1au] AAAA? 7cf36e0b3a88.gw.mujsrv.org. (53) 20:27:55.545573 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.36822: 58603 NXDomain 0/1/1 (138) 20:27:55.545752 enp4s0 Out IP 172.31.48.127.36822 > 172.31.48.254.53: 58603+ AAAA? 7cf36e0b3a88.gw.mujsrv.org. (42) 20:27:55.546081 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.36822: 58603 NXDomain 0/1/0 (127) 20:27:55.548708 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.44308: 3278 NXDomain 0/1/1 (138) 20:27:55.549710 enp4s0 Out IP 172.31.48.127.60509 > 172.31.48.254.53: 41153+ [1au] A? bd30780f6ca9.gw.mujsrv.org. (53) 20:27:55.549819 enp4s0 Out IP 172.31.48.127.35849 > 172.31.48.254.53: 43141+ [1au] AAAA? bd30780f6ca9.gw.mujsrv.org. (53) 20:27:55.610201 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.60509: 41153 NXDomain 0/1/1 (138) 20:27:55.610256 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.35849: 43141 NXDomain 0/1/1 (138) 20:27:55.610349 enp4s0 Out IP 172.31.48.127.60509 > 172.31.48.254.53: 41153+ A? bd30780f6ca9.gw.mujsrv.org. (42) 20:27:55.610427 enp4s0 Out IP 172.31.48.127.35849 > 172.31.48.254.53: 43141+ AAAA? bd30780f6ca9.gw.mujsrv.org. (42) 20:27:55.610635 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.60509: 41153 NXDomain 0/1/0 (127) 20:27:55.610677 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.35849: 43141 NXDomain 0/1/0 (127) 20:28:15.631685 enp4s0 Out IP 172.31.48.127.46400 > 172.31.48.254.53: 33469+ [1au] A? 041d1d870348.gw.mujsrv.org. (53) 20:28:15.631799 enp4s0 Out IP 172.31.48.127.38725 > 172.31.48.254.53: 21530+ [1au] AAAA? 041d1d870348.gw.mujsrv.org. (53) 20:28:15.776090 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.46400: 33469 NXDomain 0/1/1 (138) 20:28:15.776145 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.38725: 21530 NXDomain 0/1/1 (138) 20:28:15.776247 enp4s0 Out IP 172.31.48.127.46400 > 172.31.48.254.53: 33469+ A? 041d1d870348.gw.mujsrv.org. (42) 20:28:15.776330 enp4s0 Out IP 172.31.48.127.38725 > 172.31.48.254.53: 21530+ AAAA? 041d1d870348.gw.mujsrv.org. (42) 20:28:15.776663 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.46400: 33469 NXDomain 0/1/0 (127) 20:28:15.776711 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.38725: 21530 NXDomain 0/1/0 (127) 20:28:15.777705 enp4s0 Out IP 172.31.48.127.40721 > 172.31.48.254.53: 22744+ [1au] A? 3f9917dadb55.gw.mujsrv.org. (53) 20:28:15.777813 enp4s0 Out IP 172.31.48.127.57177 > 172.31.48.254.53: 3045+ [1au] AAAA? 3f9917dadb55.gw.mujsrv.org. (53) 20:28:15.817539 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.57177: 3045 NXDomain 0/1/1 (138) 20:28:15.817593 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.40721: 22744 NXDomain 0/1/1 (138) 20:28:15.817716 enp4s0 Out IP 172.31.48.127.57177 > 172.31.48.254.53: 3045+ AAAA? 3f9917dadb55.gw.mujsrv.org. (42) 20:28:15.817797 enp4s0 Out IP 172.31.48.127.40721 > 172.31.48.254.53: 22744+ A? 3f9917dadb55.gw.mujsrv.org. (42) 20:28:15.817997 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.57177: 3045 NXDomain 0/1/0 (127) 20:28:15.818074 enp4s0 In IP 172.31.48.254.53 > 172.31.48.127.40721: 22744 NXDomain 0/1/0 (127) .... # tail -f /var/log/messages Apr 16 20:27:55 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: 7cf36e0b3a88.gw.mujsrv.org:1194 (Name or service not known) Apr 16 20:27:55 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: bd30780f6ca9.gw.mujsrv.org:1194 (Name or service not known) Apr 16 20:27:55 pc-jana nm-openvpn[786758]: Could not determine IPv4/IPv6 protocol Apr 16 20:27:55 pc-jana nm-openvpn[786758]: SIGUSR1[soft,init_instance] received, process restarting Apr 16 20:28:15 pc-jana nm-openvpn[786758]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Apr 16 20:28:15 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: 041d1d870348.gw.mujsrv.org:1194 (Name or service not known) Apr 16 20:28:15 pc-jana nm-openvpn[786758]: RESOLVE: Cannot resolve host address: 3f9917dadb55.gw.mujsrv.org:1194 (Name or service not known) Apr 16 20:28:15 pc-jana nm-openvpn[786758]: Could not determine IPv4/IPv6 protocol Apr 16 20:28:15 pc-jana nm-openvpn[786758]: SIGUSR1[soft,init_instance] received, process restarting Apr 16 20:28:24 pc-jana nm-openvpn[786758]: SIGTERM[hard,init_instance] received, process exiting ... >From above, NM tries DNS result not for 'gw.mujsrv.org' host, but for some insane 7cf36e0b3a88.gw.mujsrv.org / bd30780f6ca9.gw.mujsrv.org / 041d1d870348.gw.mujsrv.org / 3f9917dadb55.gw.mujsrv.org /... Can anyone see where the problem might be? And one more, perhaps not a very important little thing: is it possible to tell the NM to do only IPv4 resolution of the vpn server name (it does not have an IPv6 address)? --- Thanks in advance, Franta Hanzlik _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
