NetworkManager + fortisslvpn can no longer connect after update #231038
Comments
|
On older generation, NetworkManager succesfully connects and here's the log maj 10 11:19:08 BigPC systemd[1]: Starting Network Manager...
maj 10 11:19:08 BigPC systemd[1]: Started Network Manager.
maj 10 11:19:33 BigPC NetworkManager[3197]: INFO: Connected to gateway.
maj 10 11:19:33 BigPC NetworkManager[3197]: INFO: Authenticated.
maj 10 11:19:33 BigPC NetworkManager[3197]: INFO: Remote gateway has allocated a VPN.
maj 10 11:19:33 BigPC pppd[3201]: Plugin /nix/store/icwbvs7hzxrxc6ch7sj61hi3fn2k6ik4-NetworkManager-fortisslvpn-gnome-1.4.0/lib/pppd/2.4.5/nm-fortisslvpn-pppd-plugin.so loaded.
maj 10 11:19:33 BigPC NetworkManager[3201]: Plugin /nix/store/icwbvs7hzxrxc6ch7sj61hi3fn2k6ik4-NetworkManager-fortisslvpn-gnome-1.4.0/lib/pppd/2.4.5/nm-fortisslvpn-pppd-plugin.so loaded.
maj 10 11:19:33 BigPC pppd[3201]: pppd 2.4.9 started by root, uid 0
maj 10 11:19:33 BigPC pppd[3201]: Using interface ppp0
maj 10 11:19:33 BigPC NetworkManager[3201]: Using interface ppp0
maj 10 11:19:33 BigPC NetworkManager[3201]: Connect: ppp0 <--> /dev/pts/0
maj 10 11:19:33 BigPC pppd[3201]: Connect: ppp0 <--> /dev/pts/0
maj 10 11:19:33 BigPC NetworkManager[3201]: {/tmp/.X5VA41} {/tmp}
maj 10 11:19:33 BigPC NetworkManager[3201]: {/tmp/.X5VA41} {.X5VA41}
maj 10 11:19:33 BigPC NetworkManager[3197]: INFO: Got addresses: [OBFUSCATED], ns [OBFUSCATED, 0.0.0.0], ns_suffix [OBFUSCATED]
maj 10 11:19:33 BigPC NetworkManager[3197]: INFO: Negotiation complete.
maj 10 11:19:35 BigPC NetworkManager[3197]: INFO: Negotiation complete.
maj 10 11:19:35 BigPC pppd[3201]: local IP address OBFUSCATED
maj 10 11:19:35 BigPC NetworkManager[3201]: local IP address OBFUSCATED
maj 10 11:19:35 BigPC NetworkManager[3201]: remote IP address OBFUSCATED
maj 10 11:19:35 BigPC pppd[3201]: remote IP address OBFUSCATED
maj 10 11:19:35 BigPC NetworkManager[3201]: Can't execute /etc/ppp/ip-up: Permission denied
maj 10 11:19:35 BigPC pppd[3201]: Can't execute /etc/ppp/ip-up: Permission denied
maj 10 11:19:35 BigPC NetworkManager[3197]: INFO: Interface ppp0 is UP.
maj 10 11:19:35 BigPC NetworkManager[3197]: INFO: Tunnel is up and running.-> % nix-shell -p nix-info --run "nix-info -m"
- system: `"x86_64-linux"`
- host os: `Linux 6.1.26, NixOS, 23.05 (Stoat), 23.05.20230429.3dcff81`
- multi-user?: `yes`
- sandbox: `yes`
- version: `nix-env (Nix) 2.13.3`
- channels(root): `"nixos"`
- channels(dominik): `""`
- channels(dkl): `"nixpkgs"`
- nixpkgs: `/home/dkl/.nix-defexpr/channels/nixpkgs` |
|
Uh, I don't know... perhaps updating to latest commit instead of just pulling the patches? For example: master...vcunat:nixpkgs:p/networkmanager-fortisslvpn |
Unfortunately, the same result maj 14 00:34:38 BigPC NetworkManager[3257]: INFO: Connected to gateway.
maj 14 00:34:38 BigPC NetworkManager[3257]: INFO: Authenticated.
maj 14 00:34:38 BigPC NetworkManager[3257]: INFO: Remote gateway has allocated a VPN.
maj 14 00:34:38 BigPC pppd[3261]: Plugin /nix/store/9d7mdq5vhqmc1w6vyxg1hb13c13nimhh-NetworkManager-fortisslvpn-gnome-unstable-2023-03-07/lib/pppd/2.5.0/nm-fortisslvpn-pppd-plugin.so loaded.
maj 14 00:34:38 BigPC NetworkManager[3261]: Plugin /nix/store/9d7mdq5vhqmc1w6vyxg1hb13c13nimhh-NetworkManager-fortisslvpn-gnome-unstable-2023-03-07/lib/pppd/2.5.0/nm-fortisslvpn-pppd-plugin.so loaded.
maj 14 00:34:38 BigPC pppd[3261]: pppd 2.5.0 started by root, uid 0
maj 14 00:34:38 BigPC pppd[3261]: Using interface ppp0
maj 14 00:34:38 BigPC NetworkManager[3261]: Using interface ppp0
maj 14 00:34:38 BigPC NetworkManager[3261]: Connect: ppp0 <--> /dev/pts/0
maj 14 00:34:38 BigPC pppd[3261]: Connect: ppp0 <--> /dev/pts/0
maj 14 00:34:38 BigPC NetworkManager[3261]: {/tmp/.A04D51} {/tmp}
maj 14 00:34:38 BigPC NetworkManager[3261]: {/tmp/.A04D51} {.A04D51}
maj 14 00:34:38 BigPC NetworkManager[3257]: INFO: Got addresses: [10.x.x.x], ns [x.x.x.x, 0.0.0.0], ns_suffix [blablabla]
maj 14 00:34:38 BigPC NetworkManager[3257]: INFO: Negotiation complete.
maj 14 00:34:40 BigPC NetworkManager[3257]: INFO: Negotiation complete.
maj 14 00:34:40 BigPC NetworkManager[3261]: Peer refused to agree to his IP address
maj 14 00:34:40 BigPC NetworkManager[3261]: Connect time 0.1 minutes.
maj 14 00:34:40 BigPC NetworkManager[3261]: Sent 1101 bytes, received 1081 bytes.
maj 14 00:34:40 BigPC pppd[3261]: Peer refused to agree to his IP address
maj 14 00:34:40 BigPC pppd[3261]: Connect time 0.1 minutes.
maj 14 00:34:40 BigPC pppd[3261]: Sent 1101 bytes, received 1081 bytes.
maj 14 00:35:39 BigPC NetworkManager[1339]: <warn> [1684017339.5801] vpn[0x19144c0,0ba639c5-a719-44ba-8e06-1c519231cac6,"Unity VPN"]: connect timeout exceeded
maj 14 00:35:39 BigPC nm-fortisslvpn-[3234]: Connect timer expired, disconnecting.
maj 14 00:35:39 BigPC NetworkManager[3257]: INFO: Cancelling threads...
maj 14 00:35:39 BigPC NetworkManager[3257]: INFO: Cleanup, joining threads...
maj 14 00:35:39 BigPC NetworkManager[3261]: Hangup (SIGHUP)
maj 14 00:35:39 BigPC NetworkManager[3261]: Modem hangup
maj 14 00:35:39 BigPC pppd[3261]: Hangup (SIGHUP)
maj 14 00:35:39 BigPC NetworkManager[3261]: Connection terminated.
maj 14 00:35:39 BigPC NetworkManager[3261]: unable to delete pid file /var/run/pppdppp0.pid: Permission denied
maj 14 00:35:39 BigPC pppd[3261]: Modem hangup
maj 14 00:35:39 BigPC pppd[3261]: Connection terminated.
maj 14 00:35:39 BigPC pppd[3261]: unable to delete pid file /var/run/pppdppp0.pid: Permission denied
maj 14 00:35:39 BigPC pppd[3261]: Exit.
maj 14 00:35:39 BigPC NetworkManager[3257]: INFO: pppd: The link was terminated by the modem hanging up.
maj 14 00:35:39 BigPC NetworkManager[3257]: INFO: Terminated pppd.
maj 14 00:35:39 BigPC NetworkManager[3257]: INFO: Closed connection to gateway.
maj 14 00:35:39 BigPC NetworkManager[3257]: INFO: Logged out.I'll try to downgrade individual packages to see what helps. |
|
I'd guess that |
|
I finally made it to build it with ppp 2.4.9 (it triggered a lot of compilation), but sadly looks like that didn't help I used such overlay And the output I don't know if that can be related to permission denied while accessing /etc/ppp/ip-{up,down}? There were some other differences in the update patch and I didn't reverse everything. I'll leave it like that and try to also roll back NetworkManager fortisslvpn plugin |
|
Trying to connect directly using openfortivpn also doesn't work and I already installed previous version (1.20.2) |
|
Using latest unstable, I managed to connect using openfortivpn by adding |
|
For me |
|
Same issue here. Happened after upgrading from 22.11 to 23.05. Both of the following workarounds worked for me:
|
|
just echoing that for me the solution was also {
environment.etc.ppp.options.text = "ipcp-accept-remote";
} |
|
It should be fixed upstream by adrienverge/openfortivpn#1111 in the upcoming release 1.20.4. |
|
networkmanager-fortisslvpn on Arch Linux (extra-testing repo which has been upgraded ppp to 2.5.0 and networkmanager-fortisslvpn has been rebuilt with that) still has the problem, on openfortivpn latest commit (which includes Executing There are some commits like this https://gitlab.gnome.org/GNOME/NetworkManager-fortisslvpn/-/merge_requests/27 regarding ppp 2.5.0, but it hasn't made through a tag though. |
|
Just adding Downgrading to ppp 2.4.9 isn't an option since the build time is immense. How do I apply the |
|
That patch was needed to even build it, so it is applied already (b4135f4). |
|
Then it seems that the problem might lay elsewhere. Any ideas on how to debug this? $ cat /etc/ppp/options
ipcp-accept-remoteLogs And my environment.systemPackages = with pkgs; [
networkmanager-fortisslvpn
];Using the following expression in networking.networkmanager = {
enable = true;
plugins = [
pkgs.networkmanager-fortisslvpn
];
};Along with system info: I am trying to figure out what else might be causing this problem. (P.S. IP Addresses have been obfuscated) |
|
Unfortunately, I had to revert the change in 1.20.4 in 1.20.5, because it breaks macOS and NetworkManager-fortivpnssl with pppd 2.4.9, until I can find time to understand and solve the problem.
|
|
|
|
With VPN: Without VPN: As you can see, to send 5 packets with the VPN on it takes over 30s, whereas with the VPN disabled it takes only 4s. The package is installed with the expression present in environment.systemPackages = with pkgs; [
networkmanager-fortisslvpn
];I will try to look further into it and see if I can come up with a fix. Thanks a lot for your assistance |
|
Actually, google.com is a bad example, because it has both IPv4 and IPv6 addresses, and openfortivpn does not support IPv6 (adrienverge/openfortivpn#112):
In any case, experiment with IPv4 addresses to start with. |
|
Hi, |
Hello I've had this in my config ever since this issue came up and it fixed openfortivpn via CLI but not NetworkManager. Can you confirm that this is working in NetworkManager? |
It only causes NetworkManager to report the tunnel to be opened, but it is non-functional. There's at least the following error message in my journal |
|
I also debugged this some more. Something creates bogus routes which lead to a disfunctional tunnel. It creates some routes to the tunnel gateway via the ppp0 interface. If I remove those routes, the tunnel gets functional. It may be a specific Forti configuration, since @dminuoso and I are working at the same company. |
|
same problem with openfortigui & ppp 2.5.0, under gentoo ipcp-accept-remote |
|
Same problem with openfortivpn & ppp 2.5.0, under Fedora 39. This workaround works fine
|
|
The new version of openfortivpn 1.21.0 will fix that, at the expense of breaking openfortivpn (by default only) on platforms with pppd < 2.5.0. |
|
Folks. Its better to use
echo $vpn_password | sudo openconnect --prot=your-gateway.domain.net:443 -u [email protected] --passwd-on-stdin
|
This is working perfectly! |
|
Any progress on it? |
Indeed after updating to ubuntu 24.10 my work VPN stopped working. I just switched to running that oneliner instead of the broken NM plugin. |
Describe the bug
After recent updates (I'm not sure which component is here to blame exactly, NM, pppd or the plugin) it can no longer connect to VPN. I can still connect fine when going back to generation made few days ago. I'll reboot to older generation to get versions of those components and post that in comments later.
Steps To Reproduce
Steps to reproduce the behavior:
1.Create Forti SSL VPN connection in NetworkManager
2. Try to connect
Expected behavior
Established connection
Screenshots
N/A
Additional context
Output from
journalctl -b -u NetworkManagerNotify maintainers
@jtojnar @vcunat @maxeaubrey
Metadata
The text was updated successfully, but these errors were encountered: