Is OpenVPN proto tcp-client supported?

[ralienpp]

I'm attempting to run gluetun with a custom OpenVPN provider, I get the following error early in the startup process

ERROR VPN settings: OpenVPN settings: custom configuration file: extracting information from custom configuration file: extracting connection from file: on line 3: extracting protocol from proto line: network protocol not supported: tcp-client
INFO Shutdown successful

Here's my custom.conf

client
dev tun
proto tcp-client
remote example.com 1194
port 1194
route 10.6.2.0 255.255.255.0 10.6.1.1
nobind
persist-key
persist-tun
tls-client
remote-cert-tls server
<ca>
-----BEGIN CERTIFICATE-----
<removed>
-----END CERTIFICATE-----
</ca>
verb 6
mute 10
cipher AES-256-CBC
auth SHA1
redirect-gateway def1

The environment for the gluetun container is

    environment:
      - VPN_SERVICE_PROVIDER=custom
      - OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
      - OPENVPN_USER=user
      - OPENVPN_PASSWORD=password

The files that are in the directory that is mounted to /gluetun are ca.crt client.crt client.key custom.conf; the client key is decrypted, the CA and client certificates are PEM-encoded.

Is proto tcp-client supported in principle?

p.s. notice that that the custom config contains <ca>....</ca> even though ca.crt is present. After reading the docs I was under the impression that it is sufficient to only include ca.crt - but this resulted in ERROR [openvpn] You must define CA file (--ca) or CA path (--capath) when attempting to start gluetun. After some tinkering, I concluded that including the CA's certificate in the config file would make the error go away. It is odd, but that's the way it is.

[pvanryn]

What happens if you try to connect directly with openvpn client (no gluetun) ?
From the wiki:

Replace the VPN server hostname by one of its IP addresses. In custom.conf, find the line starting with remote. The second field is the VPN server hostname. If it is not an IP address, you need to DNS resolve it, for example with nslookup domain.com and replace the hostname field with one of its corresponding IP addresses. This is the case as gluetun's firewall is designed not to leak anything including an initial DNS resolution when starting.

Bind mount ALL of your files:

Bind mount your custom.conf file to /gluetun/custom.conf. If you have other files such as ca.crt or up.sh, bind mount them to /gluetun/ as well.

[ralienpp]

Thanks for your feedback.

• Using OpenVPN directly works as expected.
• Name vs address - this is an omission on my side; my config actually contains the IP address, but prior to posting my question I sanitized it and replaced it with "example.com". In practice, the line reads remote <ip address of server> 1194, so this is not the cause of the problem.

As for your last point, all the files are there. I use Docker compose as follows:

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 6881:6881
      - 6881:6881/udp
      - 8085:8085
    volumes:
      - /projects/gluetun:/gluetun
    environment:
      - VPN_SERVICE_PROVIDER=custom
      - OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
      - OPENVPN_USER=user
      - OPENVPN_PASSWORD=password

The contents of /projects/gluetun: ca.crt client.crt client.key custom.conf. I am sure the files are accessible, since the error message indicates that there is indeed an attempt to parse the file, and something is odd at line 3. Otherwise, the error message would be that the file is not found.

@pvanryn, do you have any further thoughts about it?

[Kata-sudo]

Can I use UDP inside openvpn proto tcp config tunnel?