Arch Linux User Repository

Please note the following requirements for AWS VPN Client:

• If you depend on DNS servers from VPN you need to have a running systemd-resolved.service. Please ensure it does not conflict with any other DNS resolver service or configuration you may use. sudo systemctl --now enable systemd-resolved.service

• You have to enable and start the awsvpnclient.service after installation: sudo systemctl --now enable awsvpnclient

For troubelshooting its worth checking first the logs:

/home/$USER/.config/AWSVPNClient/
/var/log/aws-vpn-client/$USER/

See also the official docs: https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-linux.html

If you face any other problem please check the troubleshooting guide (DNS issues): https://docs.aws.amazon.com/vpn/latest/clientvpn-user/linux-troubleshooting.html#aws-provided-client

When trying to connect, I get "Unknown Error Occured" BUT I have an issue that I don't see anyone else having. It seems to be with the awsvpnclient.service.

https://paste.ubuntu.com/p/Ntz8TxT3QM/

Service invoking user does not have read access over Notice the whitespace after user? It's like the service does not know what user to use. It gives me that read access error even if I chmod 777 the current_connection.txt file.

EDIT: Fixed! my users command was busted. I am using Garuda Linux and my /var/run/utmp file did not exist at all. what i did was a symbolic link /var/run/utmp -> /var/log/wtmp and this fixed everything.

@bam365 thanks for letting us know the problem! I updated the package with the missing dependency ;-)

@bam365 that fixed it for me! thank you very much :)

For those getting "Unknown error occurred" when trying to connect, and the log file in /var/log/aws-vpn-client/$USER/ shows that it fails after opening the openvpn management interface, which looks like this in the log:

2021-07-05 11:07:41.423 +02:00 [DBG] [TI=11] [PID: 4121] Mon Jul  5 11:07:41 2021 Need password(s) from management interface, waiting...
2021-07-05 11:07:42.433 +02:00 [DBG] [TI=13] Wait for OpenVPN processes to finish graceful shutdown

This might be because you do not have the lsof command installed. Try installing it with pacman -S lsof and see if that fixes the issue.

I have a colleague that's using the same .ovpn file in Ubuntu and it works for him, so this seems to be somehow tied to Arch... I understand it's not easy to support @project0, thanks for the help anyway!

@7thSon do you even use federated-auth? (If not i would prefer not using AWS VPN and stick to native OpenVPN).

In /home/$USER/.config/AWSVPNClient/ should also be a separate openvpn log. I would check this as well, maybe something is wrong with your configuration (ovpn file).

Also double check the awsvpnclient is running (the logs does not indicate it, but who knows, maybe it crashes?). Maybe trying first on a supported OS would clarify if the problem is really the client/OS setup or some other miss configuration.

I am afraid that i cannot help more, AWS officially only supports Ubuntu for their client right now and do not share the source code of their implementation :-(.

FWIW I get the exact same error and logs as @7thSon, so we're probably missing the same thing (?)

@project0 Of course, I get an error when I try to connect using the AWS VPN Client gui, after having added my profile and selecting the .ovpn file, when I click "Connect" I just get an error dialog saying "Unknown error occurred. Try again.". The log I posted below is from clicking "Connect" in the gui tool.

The log in /home/$USER/.config/AWSVPNClient/ prints this when I try to connect with the gui: https://hastebin.com/denurinigu.less

@7thSon Can you share more details about the error you retrieve? I still do not understand at which point you face problems (opening the browser? Error message before?). Did you also checked the logs in /home/$USER/.config/AWSVPNClient/?

Do you use federated-auth (SAML)?

I'm also having problems with this, at the end of the log I get this:

2021-07-05 11:07:41.412 +02:00 [DBG] [TI=13] Starting OpenVPN process with command: "/opt/awsvpnclient/Service/Resources/openvpn/acvc-openvpn" --config "/home/user/.config/AWSVPNClient/OpenVpnConfigs/AWSVPN" --management 127.0.0.1 8096 "/home/user/.config/AWSVPNClient/acvc-8096.txt" --management-query-passwords --script-security 2 --up /opt/awsvpnclient/Service/Resources/openvpn/configure-dns --down /opt/awsvpnclient/Service/Resources/openvpn/configure-dns --up-restart --down-pre
2021-07-05 11:07:41.413 +02:00 [DBG] [TI=11] Listening for OpenVPN output from [4121]
2021-07-05 11:07:41.422 +02:00 [DBG] [TI=11] [PID: 4121] Mon Jul  5 11:07:41 2021 WARNING: file '/home/user/.config/AWSVPNClient/acvc-8096.txt' is group or others accessible
2021-07-05 11:07:41.423 +02:00 [DBG] [TI=11] [PID: 4121] Mon Jul  5 11:07:41 2021 OpenVPN 2.4.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb 19 2021
2021-07-05 11:07:41.423 +02:00 [DBG] [TI=11] [PID: 4121] Mon Jul  5 11:07:41 2021 library versions: OpenSSL 1.0.2u  20 Dec 2019
2021-07-05 11:07:41.423 +02:00 [DBG] [TI=11] [PID: 4121] Mon Jul  5 11:07:41 2021 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:8096
2021-07-05 11:07:41.423 +02:00 [DBG] [TI=11] [PID: 4121] Mon Jul  5 11:07:41 2021 Need password(s) from management interface, waiting...
2021-07-05 11:07:42.433 +02:00 [DBG] [TI=13] Wait for OpenVPN processes to finish graceful shutdown
2021-07-05 11:07:42.439 +02:00 [DBG] [TI=13] OpenVPN process may still in graceful shutdown. Sleep 300 ms
2021-07-05 11:07:42.750 +02:00 [DBG] [TI=13] OpenVPN process may still in graceful shutdown. Sleep 300 ms
2021-07-05 11:07:43.073 +02:00 [DBG] [TI=13] OpenVPN process may still in graceful shutdown. Sleep 300 ms
2021-07-05 11:07:43.396 +02:00 [DBG] [TI=13] Finished waiting OpenVPN graceful shutdown. Proceed with killing any orphaned OpenVPN processes
2021-07-05 11:07:43.406 +02:00 [DBG] Attempting to kill process: 4121
2021-07-05 11:07:43.506 +02:00 [DBG] Orphaned process are alive: False
2021-07-05 11:07:43.506 +02:00 [DBG] [TI=13] Attempting to restore /etc/resolv.conf if /etc/resolv.conf.ovpnsave exists
2021-07-05 11:07:43.506 +02:00 [DBG] [TI=13] /etc/resolv.conf.ovpnsave not found

It looks like the process expects a password from a management interface, but then immediately fails and shuts down openvpn.

I have set up systemd-resolved and awsvpnclient services as instructed here, as well as updated nsswitch.conf. When I start the awsvpn gui client and try to connect I still get the "Unknown error occurred. Try again" error dialog.

I also tried xdg-open 'http://google.com' and it opens up a browser tab just fine.