Finally found the issue, for some reason the tls key was wrong (dont even ask, have no idea how that happened)........
@Luksus
Didnt rebbot after turning volte off but doesnt seem to effect the vpn.
/edit
Well ping doesnt go through the tunnel but normal web traffic does, openvpn could really have a bit more clearer error messages. Like "Invalid tls key" or something instead of and obtuse " Insufficient key material or header text not found in file '[[INLINE]]' ".....
@arubislander said in OpenVPN setup does not offer what i need for my vpn server....:
@jagdtigger Do you have an Ubuntu Desktop PC you could configure your VPN on and see if it works? Preferably one running the very same base version as the UT you have on your device. So 20.04 or 24.04.
Once you get that set-up in a satisfactory manner, you could then export the configuration to a .ovpn file, which you could then install with
nmclion UT.
Sorry for the long radio silence, i was practically zombie the whole week. ATM i do not have any machines that run ubuntu, but my router does have a ovpn export. Here is a redacted version:
dev tun
persist-tun
persist-key
data-ciphers AES-256-GCM:CHACHA20-POLY1305
data-ciphers-fallback AES-256-GCM
auth SHA512
tls-client
client
resolv-retry infinite
remote domain port udp4
setenv opt block-outside-dns
nobind
verify-x509-name "some-name" name
auth-user-pass
remote-cert-tls server
explicit-exit-notify
redirect-gateway def1
<ca>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN EC PRIVATE KEY-----
<snip>
-----END EC PRIVATE KEY-----
</key>
<tls-crypt>
#
# <snip> bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
<snip>
-----END OpenVPN Static key V1-----
</tls-crypt>
/EDIT
Nope, it wont connect. Errors in vpn server log:
TLS Error: tls-crypt unwrapping failed from [AF_INET]<phone_ip>
tls-crypt unwrap error: packet too short
(And yes im trying to connect over cellular not local wifi.)
Finally found the issue, for some reason the tls key was wrong (dont even ask, have no idea how that happened)........
@Luksus
Didnt rebbot after turning volte off but doesnt seem to effect the vpn.
/edit
Well ping doesnt go through the tunnel but normal web traffic does, openvpn could really have a bit more clearer error messages. Like "Invalid tls key" or something instead of and obtuse " Insufficient key material or header text not found in file '[[INLINE]]' ".....
Had a bit of time playing with this. Looks like when i add the needed luser+pass UT borks the config.
After import but before edit in gui:
root@ubuntu-phablet:/home/phablet/Documents/vpn# cat /etc/netplan/90-NM-52d84ad9-6e22-45a6-b0cc-77e6639f57dc.yaml
network:
version: 2
nm-devices:
NM-52d84ad9-6e22-45a6-b0cc-77e6639f57dc:
renderer: NetworkManager
networkmanager:
uuid: "52d84ad9-6e22-45a6-b0cc-77e6639f57dc"
name: "main-vpn"
passthrough:
connection.type: "vpn"
vpn.ca: "/home/phablet/Documents/vpn/server.crt"
vpn.cert: "/home/phablet/Documents/vpn/phone.crt"
vpn.connection-type: "password-tls"
vpn.dev: "tun"
vpn.dev-type: "tun"
vpn.key: "/home/phablet/Documents/vpn/phone.key"
vpn.password-flags: "1"
vpn.port: "<port>"
vpn.remote: "<domain>"
vpn.tls-crypt: "/home/phablet/Documents/vpn/tls.key"
vpn.tls-version-min: "1.3"
vpn.tls-version-min-or-highest: "yes"
vpn.tun-ipv6: "yes"
vpn.service-type: "org.freedesktop.NetworkManager.openvpn"
ipv4.method: "auto"
ipv6.addr-gen-mode: "default"
ipv6.method: "auto"
proxy._: ""
After adding user+pass:
root@ubuntu-phablet:/home/phablet/Documents/vpn# cat /etc/netplan/90-NM-52d84ad9-6e22-45a6-b0cc-77e6639f57dc.yaml
network:
version: 2
nm-devices:
NM-52d84ad9-6e22-45a6-b0cc-77e6639f57dc:
renderer: NetworkManager
networkmanager:
uuid: "52d84ad9-6e22-45a6-b0cc-77e6639f57dc"
name: "main-vpn"
passthrough:
connection.type: "vpn"
vpn.ca: "/home/phablet/Documents/vpn/server.crt"
vpn.cert: "/home/phablet/Documents/vpn/phone.crt"
vpn.cert-pass-flags: "1"
vpn.connection-type: "password-tls"
vpn.dev: "tun"
vpn.dev-type: "tun"
vpn.key: "/home/phablet/Documents/vpn/phone.key"
vpn.password-flags: "1"
vpn.port: "<port>"
vpn.remote: "<domain>"
vpn.username: "phone"
vpn.service-type: "org.freedesktop.NetworkManager.openvpn"
ipv4.method: "auto"
ipv6.addr-gen-mode: "default"
ipv6.method: "auto"
proxy._: ""
Emtyied the file then inserted the origynal config, reboot, then trying to connect with nmcli:
phablet@ubuntu-phablet:~$ sudo su -
[sudo] password for phablet:
root@ubuntu-phablet:~# nano /etc/netplan/90-NM-52d84ad9-6e22-45a6-b0cc-77e6639f57dc.yaml
root@ubuntu-phablet:~# nmcli con up id main-vpn --ask
A password is required to connect to 'main-vpn'.
Password (vpn.secrets.password): ••••••••••
Error: Connection activation failed: The VPN service stopped unexpectedly
Hint: use 'journalctl -xe NM_CONNECTION=52d84ad9-6e22-45a6-b0cc-77e6639f57dc + NM_DEVICE=ril_0' to get more details.
Output from yournalctl from the last line:
Nov 03 19:44:41 ubuntu-phablet NetworkManager[1855]: <info> [1762195481.3645] manager: (ril_0): new Broadband device (/org/freedesktop/NetworkManager/Devices/8)
Nov 03 19:44:41 ubuntu-phablet NetworkManager[1855]: <info> [1762195481.3696] device (ril_0): state change: unmanaged -> unavailable (reason 'managed', sys-iface-state: 'external')
Nov 03 19:44:41 ubuntu-phablet NetworkManager[1855]: <info> [1762195481.3704] device (ril_0): modem state 'initializing'
Nov 03 19:45:22 ubuntu-phablet NetworkManager[1855]: <info> [1762195522.7025] device (ril_0): state change: unavailable -> disconnected (reason 'modem-available', sys-iface-state: 'managed')
Nov 03 19:45:22 ubuntu-phablet NetworkManager[1855]: <info> [1762195522.7151] device (ril_0): Activation: starting connection 'Vodafone HU' (45cef972-7709-52f9-90a2-6b67d193ddf6)
Nov 03 19:45:22 ubuntu-phablet NetworkManager[1855]: <info> [1762195522.7154] device (ril_0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'managed')
Nov 03 19:45:23 ubuntu-phablet NetworkManager[1855]: <info> [1762195523.3959] device (ril_0): state change: prepare -> config (reason 'none', sys-iface-state: 'managed')
Nov 03 19:45:23 ubuntu-phablet NetworkManager[1855]: <info> [1762195523.4014] device (ril_0): state change: config -> ip-config (reason 'none', sys-iface-state: 'managed')
Nov 03 19:45:23 ubuntu-phablet NetworkManager[1855]: <warn> [1762195523.4075] device (ril_0): retrieving IP configuration failed: modem IP method unsupported
Nov 03 19:45:23 ubuntu-phablet NetworkManager[1855]: <info> [1762195523.4530] device (ril_0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'managed')
Nov 03 19:45:23 ubuntu-phablet NetworkManager[1855]: <info> [1762195523.5092] device (ril_0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'managed')
Nov 03 19:45:23 ubuntu-phablet NetworkManager[1855]: <info> [1762195523.5101] device (ril_0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'managed')
Nov 03 19:45:23 ubuntu-phablet NetworkManager[1855]: <info> [1762195523.5122] device (ril_0): Activation: successful, device activated.
Nov 03 19:46:05 ubuntu-phablet NetworkManager[1855]: <info> [1762195565.5396] vpn[0x55b0078e60,52d84ad9-6e22-45a6-b0cc-77e6639f57dc,"main-vpn"]: starting openvpn
Not much, lets see what journalctl -e had to offer:
Nov 03 19:54:14 ubuntu-phablet NetworkManager[1855]: <info> [1762196054.8404] agent-manager: agent[75085e56325963a9,:1.110/nmcli-connect/0]: agent registered
Nov 03 19:54:14 ubuntu-phablet NetworkManager[1855]: <info> [1762196054.8451] vpn[0x55b0071c60,52d84ad9-6e22-45a6-b0cc-77e6639f57dc,"main-vpn"]: starting openvpn
Nov 03 19:54:14 ubuntu-phablet NetworkManager[1855]: <info> [1762196054.8475] audit: op="connection-activate" uuid="52d84ad9-6e22-45a6-b0cc-77e6639f57dc" name="main-vpn" pid=5266 uid=0 result="success"
Nov 03 19:54:19 ubuntu-phablet NetworkManager[5278]: 2025-11-03 19:54:19 Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: Note: --cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback ple>
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: WARNING: file '/home/phablet/Documents/vpn/phone.key' is group or others accessible
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: OpenVPN 2.6.14 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: library versions: OpenSSL 3.0.13 30 Jan 2024, LZO 2.10
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: DCO version: N/A
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: Insufficient key material or header text not found in file '[[INLINE]]' (0/128/256 bytes found/min/max)
Nov 03 19:54:19 ubuntu-phablet nm-openvpn[5278]: Exiting due to fatal error
Nov 03 19:54:19 ubuntu-phablet NetworkManager[1855]: <warn> [1762196059.3200] vpn[0x55b0071c60,52d84ad9-6e22-45a6-b0cc-77e6639f57dc,"main-vpn"]: dbus: failure: connect-failed (1)
Nov 03 19:54:19 ubuntu-phablet NetworkManager[1855]: <warn> [1762196059.3222] vpn[0x55b0071c60,52d84ad9-6e22-45a6-b0cc-77e6639f57dc,"main-vpn"]: dbus: failure: connect-failed (1)
Nov 03 19:54:19 ubuntu-phablet lomiri-indicator-network-service[4655]: Debug: VPN Connection Failed "The VPN connection 'main-vpn' failed." ((null):0, (null))
Nov 03 19:54:19 ubuntu-phablet lomiri-indicator-network-service[4655]: Debug: VPN Connection Failed "The VPN connection 'main-vpn' failed because the VPN service stopped unexpectedly." ((null):0, (null))
Im out of ideas at this point..... 
@Vlad-Nirky
Every other client, including this phone with the openvpn app when it was running android connected just fine so i have doubts about the server causing it.
Server log:
Oct 26 11:23:17 openvpn 68034 openvpn server 'ovpns1' user '<phone>' address '<phone_ip>:2866' - connected
Oct 26 11:23:17 openvpn 89539 MULTI_sva: push_ifconfig_ipv6 <ip6>
Oct 26 11:23:16 openvpn 63105 openvpn server 'ovpns1' user '<phone>' address '<phone_ip>:2866' - connecting
Oct 26 11:23:16 openvpn 89539 phone/<phone_ip>:2866 MULTI_sva: push_ifconfig_ipv6 <ip6>
Oct 26 11:23:16 openvpn 89539 phone/<phone_ip>:2866 MULTI_sva: pool returned IPv4=10.125.220.2, IPv6=<ip6>
Oct 26 11:23:15 openvpn 5699 user '<phone>' authenticated
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 [phone] Peer Connection Initiated with [AF_INET]<phone_ip>:2866
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_COMP_STUBv2=1
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_COMP_STUB=1
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_LZO_STUB=1
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_PROTO=990
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_CIPHERS=AES-256-GCM:CHACHA20-POLY1305
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_MTU=1600
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_TCPNL=1
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_PLAT=linux
Oct 26 11:23:15 openvpn 89539 <phone_ip>:2866 peer info: IV_VER=2.6.14
Phone console output (usb adb shell):
phablet@ubuntu-phablet:~/Documents/vpn$ sudo openvpn --config ./main-vpn.ovpn
2025-10-26 11:23:09 Unrecognized option or missing or extra parameter(s) in ./main-vpn.ovpn:11: block-outside-dns (2.6.14)
2025-10-26 11:23:09 OpenVPN 2.6.14 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2025-10-26 11:23:09 library versions: OpenSSL 3.0.13 30 Jan 2024, LZO 2.10
2025-10-26 11:23:09 DCO version: N/A
Enter Auth Username: <phone>
Enter Auth Password: ••••••••••
2025-10-26 11:23:15 TCP/UDP: Preserving recently used remote address: [AF_INET]<server>
2025-10-26 11:23:15 UDPv4 link local: (not bound)
2025-10-26 11:23:15 UDPv4 link remote: [AF_INET]<server>
2025-10-26 11:23:15 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2025-10-26 11:23:15 [openvpn_server-cr] Peer Connection Initiated with [AF_INET]<server>
2025-10-26 11:23:17 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:3: block-outside-dns (2.6.14)
2025-10-26 11:23:17 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:4: register-dns (2.6.14)
2025-10-26 11:23:17 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2025-10-26 11:23:17 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2025-10-26 11:23:17 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2025-10-26 11:23:17 sitnl_send: rtnl: generic error (-101): Network is unreachable
2025-10-26 11:23:17 TUN/TAP device tun0 opened
2025-10-26 11:23:17 net_iface_mtu_set: mtu 1500 for tun0
2025-10-26 11:23:17 net_iface_up: set tun0 up
2025-10-26 11:23:17 net_addr_v4_add: <ip4> dev tun0
2025-10-26 11:23:17 net_iface_mtu_set: mtu 1500 for tun0
2025-10-26 11:23:17 net_iface_up: set tun0 up
2025-10-26 11:23:17 net_addr_v6_add: <ip6> dev tun0
2025-10-26 11:23:17 Initialization Sequence Completed
The network unreachable error is odd, but right now the main issue is that the nmcli+ntplan combo is royally screwing up the config itself when imported or when forced to add user+pass in the gui....
@gpatel-fr
I was aware from the getgo ubuntu does stupid things like NM+NP, not to mention their obsession with their failing app packaging format.....
Anyway as i said above i think it does something iffy with the config. The tls-crypt option missing inside the netplan yaml even though it was there before import i think is a pretty good indicator of that.
@Vlad-Nirky
Did your method with the nmcli import command (only had to add the user+pass in the UT GUI), still get timeout on the phone and the same errors in openvpn log. And i think i know why. Seems like nmcli has its own mind and omitted settings from the imported config....
Original
client
remote '<domain>'
tun-ipv6
cert '/home/phablet/Documents/vpn/phone.crt'
key '/home/phablet/Documents/vpn/phone.key'
ca '/home/phablet/Documents/vpn/server.crt'
auth-user-pass
dev tun
dev-type tun
proto udp
port <port>
tls-crypt '/home/phablet/Documents/vpn/tls.key'
tls-version-min '1.3' or-highest
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user nm-openvpn
group nm-openvpn
Imported:
root@ubuntu-phablet:/home/phablet/Documents/vpn# cat /etc/netplan/90-NM-f1365f35-54fb-432f-8a95-fd811aafd906.yaml
network:
version: 2
nm-devices:
NM-f1365f35-54fb-432f-8a95-fd811aafd906:
renderer: NetworkManager
networkmanager:
uuid: "f1365f35-54fb-432f-8a95-fd811aafd906"
name: "main-vpn"
passthrough:
connection.type: "vpn"
vpn.ca: "/home/phablet/Documents/vpn/server.crt"
vpn.cert: "/home/phablet/Documents/vpn/phone.crt"
vpn.cert-pass-flags: "1"
vpn.connection-type: "password-tls"
vpn.dev: "tun"
vpn.dev-type: "tun"
vpn.key: "/home/phablet/Documents/vpn/phone.key"
vpn.password-flags: "1"
vpn.port: "<port>"
vpn.remote: "<domain>"
vpn.username: "<user>"
vpn.service-type: "org.freedesktop.NetworkManager.openvpn"
ipv4.method: "auto"
ipv6.addr-gen-mode: "default"
ipv6.method: "auto"
proxy._: ""
No wonder the server has tls errors, the tls-crypt option is missing.
@arubislander said in OpenVPN setup does not offer what i need for my vpn server....:
Do you have an Ubuntu Desktop PC you could configure your VPN on and see if it works? Preferably one running the very same base version as the UT you have on your device. So 20.04 or 24.04.
Sorry for the long radio silence, something come up. Copied over the yaml file from netplan as is leaving content and name unchanged (minus the cert and key paths). It wont show up in settings under VPN, not even a reboot makes it appear.....
Sorry for doubleposting, couldnt edit previous.
Ubuntu 24.04 finished installing. Set up vpn and works, but no export button (or im blind again(......
@arubislander said in OpenVPN setup does not offer what i need for my vpn server....:
@jagdtigger What version of UT are you on? And what channel?
24.04-1.x/arm64/android9plus/stable, the phone is a Fairphone 4.
@Vlad-Nirky said in OpenVPN setup does not offer what i need for my vpn server....:
@jagdtigger
I'm testing the VPN as well.
If I get better results, I'll let you know...
Thanks. Im installing ubuntu 24.04.3 on a minipc i have lying around for messing around.
@arubislander said in OpenVPN setup does not offer what i need for my vpn server....:
@jagdtigger Do you have an Ubuntu Desktop PC you could configure your VPN on and see if it works? Preferably one running the very same base version as the UT you have on your device. So 20.04 or 24.04.
Once you get that set-up in a satisfactory manner, you could then export the configuration to a .ovpn file, which you could then install with
nmclion UT.
Sorry for the long radio silence, i was practically zombie the whole week. ATM i do not have any machines that run ubuntu, but my router does have a ovpn export. Here is a redacted version:
dev tun
persist-tun
persist-key
data-ciphers AES-256-GCM:CHACHA20-POLY1305
data-ciphers-fallback AES-256-GCM
auth SHA512
tls-client
client
resolv-retry infinite
remote domain port udp4
setenv opt block-outside-dns
nobind
verify-x509-name "some-name" name
auth-user-pass
remote-cert-tls server
explicit-exit-notify
redirect-gateway def1
<ca>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN EC PRIVATE KEY-----
<snip>
-----END EC PRIVATE KEY-----
</key>
<tls-crypt>
#
# <snip> bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
<snip>
-----END OpenVPN Static key V1-----
</tls-crypt>
/EDIT
Nope, it wont connect. Errors in vpn server log:
TLS Error: tls-crypt unwrapping failed from [AF_INET]<phone_ip>
tls-crypt unwrap error: packet too short
(And yes im trying to connect over cellular not local wifi.)
Hello all!
Sorry about the vague title but didnt really know how to condense the issue down into a few words. So i have an openvpn server, it specifically uses aes-gcm or chacha-poly for encryption and tls-key both ways. Sadly none of this is available in the wizard. Tried to use a confid file from the cmd line and it did connect but nothing got through. Is there a way to get it done without breaking things?
Im pretty much at a loss here, if it was a regular PC running linux id start poking around on my own but im very unfamiliar with UT and its potential quirks and peculiarities......