<div dir="ltr">Sorry for the obvious, but this does mean that you need to install tun/tap in the global zone ... which I guess is the reason you're getting the permission problems.<div><br></div><div>Jon</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 21 Jan 2019 at 09:33, Jonathan Adams <<a href="mailto:t12nslookup@gmail.com">t12nslookup@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">root@moysalsrv:~# zonecfg -z vpnzone info</div><div dir="ltr">zonename: vpnzone</div><div dir="ltr">zonepath: /zones/vpnzone</div><div dir="ltr">brand: ipkg</div><div dir="ltr">autoboot: true</div><div dir="ltr">bootargs: </div><div dir="ltr">pool: </div><div dir="ltr">limitpriv: default</div><div dir="ltr">scheduling-class: </div><div dir="ltr">ip-type: exclusive</div><div dir="ltr">hostid: </div><div dir="ltr">fs-allowed: </div><div dir="ltr">net:</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>address not specified</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>allowed-address not specified</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>physical: vpninternal0</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>defrouter not specified</div><div dir="ltr">net:</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>address not specified</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>allowed-address not specified</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>physical: vpnvnic0</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>defrouter not specified</div><div dir="ltr">device:</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>match: /dev/lockstat</div><div dir="ltr">device:</div><div dir="ltr"><span style="white-space:pre-wrap"> </span>match: /dev/tun*</div><div><br></div><div>...</div><div><br></div><div>this is for a "client" rather than for a "server", but hopefully this will give you some mileage.</div><div><br></div><div>Jon</div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail-m_-7112399745971523036gmail_attr">On Mon, 21 Jan 2019 at 08:30, Jonathan Adams <<a href="mailto:t12nslookup@gmail.com" target="_blank">t12nslookup@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">I know in the past that I had to pass through specific dev interfaces. I'll take a look when I get to work, as I think we still have one box set up that way.<div dir="auto">Jon</div></div><br><div class="gmail_quote"><div dir="ltr">On Mon, 21 Jan 2019 07:46 Alexander Pyhalov via oi-dev <<a href="mailto:oi-dev@openindiana.org" target="_blank">oi-dev@openindiana.org</a> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi.<br>
I suppose some of the privileges mentioned in /lib/svc/manifest/network/openvpn.xml are not available in zone (look at method_credential section).<br>
<br>
С уважением,<br>
Александр Пыхалов,<br>
программист отдела телекоммуникационной инфраструктуры<br>
управления информационно-коммуникационной инфраструктуры ЮФУ<br>
<br>
<br>
________________________________________<br>
От: Sven Schmeling <<a href="mailto:sven.schmeling@schmeling-ol.de" rel="noreferrer" target="_blank">sven.schmeling@schmeling-ol.de</a>><br>
Отправлено: 18 января 2019 г. 23:36:17<br>
Кому: OpenIndiana Developer mailing<br>
Тема: [oi-dev] OpenVPN in a local zone<br>
<br>
Hello,<br>
<br>
i have installed OpenVPN in a local zone.<br>
<br>
Starting the service with "svcadm enable svc:/network/openvpn:default"<br>
(or rebooting the zone) ends in the maintenance mode:<br>
<br>
# svcs openvpn<br>
STATE STIME FMRI<br>
maintenance 19:46:37 svc:/network/openvpn:default<br>
<br>
cat /var/svc/log/network-openvpn:default.log<br>
<br>
[ Jan 18 19:46:37 Enabled. ]<br>
[ Jan 18 19:46:37 Executing start method ("/usr/sbin/openvpn --daemon<br>
openvpn --config '/etc/openvpn/openvpn.conf'"). ]<br>
[ Jan 18 19:46:37 svc.startd could not set context for method: ]<br>
setppriv: Not owner<br>
[ Jan 18 19:46:37 Method "start" exited with status 96. ]<br>
<br>
Hints to add "limitpriv="default,priv_net_rawaccess" to the zone config<br>
are maded but doesn't change the behavior.<br>
<br>
Starting openvpn with "/usr/sbin/openvpn --verb 9 --config<br>
'/etc/openvpn/openvpn.conf'" on the command line works fine and<br>
connections are possible.<br>
<br>
<br>
Any hints about the "setppriv" error?<br>
<br>
--------------<br>
<br>
pkg info openvpn<br>
Name: network/openvpn<br>
Summary: OpenVPN is a full-featured open source SSL VPN solution<br>
Category: Applications/Internet<br>
State: Installed<br>
Publisher: <a href="http://openindiana.org" rel="noreferrer noreferrer" target="_blank">openindiana.org</a><br>
Version: 2.4.3<br>
Branch: 2018.0.0.1<br>
Packaging Date: Sun Feb 11 13:19:38 2018<br>
Size: 1.19 MB<br>
FMRI:<br>
pkg://<a href="http://openindiana.org/network/openvpn@2.4.3-2018.0.0.1:20180211T131938Z" rel="noreferrer noreferrer" target="_blank">openindiana.org/network/openvpn@2.4.3-2018.0.0.1:20180211T131938Z</a><br>
Project URL: <a href="http://openvpn.net" rel="noreferrer noreferrer" target="_blank">http://openvpn.net</a><br>
Source URL:<br>
<a href="http://swupdate.openvpn.org/community/releases/openvpn-2.4.3.tar.xz" rel="noreferrer noreferrer" target="_blank">http://swupdate.openvpn.org/community/releases/openvpn-2.4.3.tar.xz</a><br>
<br>
--------------<br>
<br>
Thanks<br>
<br>
Sven Schmeling<br>
<br>
<br>
- --<br>
Sven Schmeling, Oldenburg, Germany<br>
mailto:<a href="mailto:sven.schmeling@schmeling-ol.de" rel="noreferrer" target="_blank">sven.schmeling@schmeling-ol.de</a><br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
oi-dev mailing list<br>
<a href="mailto:oi-dev@openindiana.org" rel="noreferrer" target="_blank">oi-dev@openindiana.org</a><br>
<a href="https://openindiana.org/mailman/listinfo/oi-dev" rel="noreferrer noreferrer" target="_blank">https://openindiana.org/mailman/listinfo/oi-dev</a></blockquote></div>
</blockquote></div>
</blockquote></div>