OpenVPN 3 Linux

OpenVPN 3 Linux differs from OpenVPN 2.x by providing full configuration and session management within the platform itself, rather than relying on external tools like Network Manager or systemd unit files.

Key Architectural Concepts

• Privilege Separation: The architecture splits functionality into several independently running backend services that communicate with a user front-end via D-Bus. This allows unprivileged users to manage their own VPN sessions securely.
• Backend Services: A collection of D-Bus services that handle specific tasks like configuration management, session management, and network configuration.
• User Front-end: The interface used by users to interact with the backend services. This project provides CLI utilities and a Python 3 module for building custom front-ends.
• D-Bus Integration: The primary communication mechanism. Any language supporting D-Bus can be used to extend or implement new front-ends.

Supported Configurations

• Routed TUN: Supported.
• TAP and Bridged: Not supported.

D-Bus is an object-oriented Inter-Process Communication (IPC) solution used by OpenVPN 3 Linux. To interact with the service, you must understand four key components:

1. Bus Type:
   • system bus: Strictly controlled and locked down; used for system-wide services.
   • session bus: Reachable by a single user session (e.g., a graphical desktop login).
2. Destination (Well-known Bus Name): A human-readable string (often reversed domain name format) used to identify a service, such as net.openvpn.v3.configuration or net.openvpn.v3.backends.
3. Object Path: A unique path within a service that identifies a specific object (e.g., /net/openvpn/v3/configuration).
4. Interface: A collection of Methods (functions you call), Properties (variables you read/write), and Signals (asynchronous events you subscribe to) available on an object.

To successfully communicate with an OpenVPN 3 service, you must provide all four: the correct bus, the destination name, the object path, and the specific interface.

Logging in OpenVPN 3 Linux is primarily handled via D-Bus signals. This design allows front-end implementations to decide how and when to present log information to the user.

Key Architectural Concepts

• Default Behavior: Log signals are sent to the net.openvpn.v3.log service (provided by openvpn3-service-log). This service automatically subscribes to log events from other services during startup, ensuring it is the primary recipient of log messages.
• Signal Broadcast Mode: Services can be run with the --signal-broadcast argument. In this mode, log signals are broadcast to all listeners. This is not recommended for production and is intended for debugging.
• D-Bus Policy: When using broadcast mode, the D-Bus policy (located at /etc/dbus-1/system.d/net.openvpn.v3.conf) must be updated, as the default policy restricts who can receive signals from OpenVPN 3 services.
• File Logging: Logging to files can be managed by a separate process or activated within individual D-Bus services. Regardless of file logging, services will still emit the Log signal over the D-Bus message bus.

To automate settings for a specific VPN profile, create a JSON file with the .autoload extension. This file must be located in the same directory as the main configuration file (.ovpn or .conf) and must have the same base filename.

Example: If your profile is vpn-client.conf, your automation file must be vpn-client.autoload.

Basic JSON Structure:

{
   "autostart": false,
   "name": "My VPN Profile",
   "acl": {
       "public": false,
       "locked-down": false,
       "set-owner": 1000
   },
   "crypto": {
       "tls-params": {
           "cert-profile": "preferred",
           "min-version": "tls_1_2"
       }
   },
   "remote": {
       "proto-override": "udp",
       "port-override": 1194,
       "timeout": 10,
       "compression": "no",
       "proxy": {
           "host": "proxy.example.com",
           "port": 8080,
           "username": "user",
           "password": "pass",
           "allow-plain-text": false
       }
   },
   "tunnel": {
       "ipv6": "default",
       "persist": true,
       "dns-fallback": "google",
       "dns-scope": "global",
       "dns-setup-disabled": false
   },
   "user-auth": {
       "autologin": true,
       "username": "vpnuser",
       "password": "vppass",
       "pk_passphrase": "keypass",
       "dynamic_challenge": "static_response"
   }
}