OpenVPN fatal errors, Cannot ioctl TUNSETIFF resin-vpn

Product support balenaOS
1

Hi there,

Recently we have started noticing (on a number of devices, all RPi 4’s) that the OpenVPN service reports Cannot ioctl TUNSETIFF resin-vpn, I believe when trying to restart the VPN service.

Another thing that is regularly observed is failures to execute any /sbin/ip commands with the error Operation not permitted.

We’ve observed these issues occurring on both balenaOS 2.115.18+rev2 and 6.0.7+rev1.

Would you be able to advise if either of these errors are a cause for concern/are they due to a misconfiguration in our setup? If so, would you be able to suggest steps to remediate? An example of this occurring is included in full below.

Thanks in advance,
Alex

openvpn INFO Preserving previous TUN/TAP instance: resin-vpn
openvpn INFO /etc/openvpn-misc/upscript.sh resin-vpn 1500 1555 10.x.x.x x.x.x.97 restart
openvpn INFO NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
openvpn INFO /sbin/ip route del x.x.x.97/32
openvpn INFO ip: RTNETLINK answers: Operation not permitted
openvpn ERROR Linux route delete command failed: external program exited with error status: 2
openvpn INFO Closing TUN/TAP interface
openvpn INFO /sbin/ip addr del dev resin-vpn local 10.x.x.x peer x.x.x.97
openvpn INFO ip: RTNETLINK answers: Operation not permitted
openvpn INFO Linux ip addr del failed: external program exited with error status: 2
openvpn INFO /etc/openvpn-misc/downscript.sh resin-vpn 1500 1555 10.x.x.x x.x.x.97 init
openvpn INFO ROUTE_GATEWAY 192.168.10.1/255.255.255.0 IFACE=eth0 HWADDR=e4:5f:01:XX:XX:XX
openvpn ERROR Cannot ioctl TUNSETIFF resin-vpn: Operation not permitted (errno=1)
openvpn fatal Exiting due to fatal error
1 Like
2

Hello @alexg first of all welcome to the balena community. My apologies for the long delay in responding to your post—I’m not sure why it didn’t appear in my list.

Could you please confirm if this has been fixed?

Thanks!

3

Hi @alexg, this is a known issue that is tracked in openvpn deescalates privileges which causes a hard failure on reconnect to different endpoint · Issue #1779 · balena-os/meta-balena · GitHub.

It happens when the openVPN connection to the server is reset - the client restarts instead of reconnecting. It’s not the desired behaviour but it’s expected in the current releases. It has no harmful effect and investigating it has never become a priority.