# How to install and configure OpenVPN? Source: https://forum.modalai.com/topic/913/how-to-install-and-configure-openvpn Category: General Questions (https://forum.modalai.com/category/2/general-questions) Posted: 2022-05-04 18:26:20 UTC by Djalma Ribeiro Replies: 36 · Views: 10534 ## Djalma Ribeiro · 2022-05-04 18:26:20 UTC How to install and configure OpenVPN on Qualcomm Flight RB5? I'm following the documentation but I'm having a lot of trouble. I have the etc/openvpn folder and I have already copied the ovpn file into it. When I run the command "openvpn --script-security 2 --config myfile.ovpn" nothing happens. When I run "systemctl enable vpn-start.service" I see the message: Failed to enable unit: Unit file vpn-start.service does not exist. Because there is no vpn-start file in the /etc/systemd/system folder Does anyone know what I should do? ## Reply by tom (ModalAI staff) · 2022-05-04 18:30:26 UTC @Djalma-Ribeiro Can you post a link to the page in the docs that you are referencing? It's possible it is outdated and needs updating. How are you connecting to the internet? 5G? WiFi? ## Reply by Djalma Ribeiro · 2022-05-04 18:46:41 UTC I'm using this one: https://docs.modalai.com/Qualcomm-Flight-RB5-user-guide-connect-network/#connecting-to-5g-network I'm using an LTE chip. I already configured it using the rb5-modem-configure command. The systemctl status -l rb5-modem command gives the following output: ![Captura de tela 2022-05-04 144334.png](https://forum.modalai.com/assets/uploads/files/1651689868282-captura-de-tela-2022-05-04-144334.png) ifconfig: ![Captura de tela 2022-05-04 144524.png](https://forum.modalai.com/assets/uploads/files/1651689947621-captura-de-tela-2022-05-04-144524.png) ## Reply by Djalma Ribeiro · 2022-05-04 18:49:37 UTC Command "systemctl enable rb5-flight-modem" Result: Failed to enable unit: Unit file rb5-flight-modem.service does not exist. ## Reply by tom (ModalAI staff) · 2022-05-04 18:54:34 UTC @Djalma-Ribeiro Okay from the `rb5-modem` service it looks like you are connecting via. LTE just fine. The `rb5-flight-modem` service you're looking for has since been renamed to `rb5-modem` so that's why you're not seeing it. Can you do a ping test to verify that the internet is working? i.e. `ping google.com` ## Reply by Djalma Ribeiro · 2022-05-04 18:57:20 UTC (in reply to tom) @tom ``` sh-4.4# ping google.com PING google.com (142.250.79.238): 56 data bytes 64 bytes from 142.250.79.238: icmp_seq=0 ttl=114 time=63.395 ms 64 bytes from 142.250.79.238: icmp_seq=1 ttl=114 time=63.037 ms 64 bytes from 142.250.79.238: icmp_seq=2 ttl=114 time=62.547 ms 64 bytes from 142.250.79.238: icmp_seq=3 ttl=114 time=66.664 ms 64 bytes from 142.250.79.238: icmp_seq=4 ttl=114 time=63.391 ms 64 bytes from 142.250.79.238: icmp_seq=5 ttl=114 time=64.499 ms 64 bytes from 142.250.79.238: icmp_seq=6 ttl=114 time=68.028 ms 64 bytes from 142.250.79.238: icmp_seq=7 ttl=114 time=75.665 ms ^C--- google.com ping statistics --- 8 packets transmitted, 8 packets received, 0% packet loss round-trip min/avg/max/stddev = 62.547/65.903/75.665/4.099 ms ``` ## Reply by tom (ModalAI staff) · 2022-05-04 19:03:51 UTC @Djalma-Ribeiro Okay perfect, now what is the output when you attempt to connect to the VPN with `openvpn --script-security 2 --config myfile.ovpn` ## Reply by Djalma Ribeiro · 2022-05-04 19:08:13 UTC (in reply to tom) @tom ``` Options error: In [CMD-LINE]:1: Error opening configuration file: /etc/openvpn/connector01_sao_paulo.ovpn ``` ![Captura de tela 2022-05-04 150743.png](https://forum.modalai.com/assets/uploads/files/1651691272376-captura-de-tela-2022-05-04-150743.png) ## Reply by tom (ModalAI staff) · 2022-05-04 19:10:25 UTC @Djalma-Ribeiro Looks like your path is wrong, you're in `/etc/openvpn/openvpn` ## Reply by Djalma Ribeiro · 2022-05-04 19:17:56 UTC (in reply to tom) @tom Hmm!!! Very well observed. I thought that was normal. I copied the files to the openvpn folder and ran the command. Result: ``` /connector01_sao_paulo.ovpnpn# openvpn --script-security 2 --config /etc/openvpn/ Wed May 4 19:14:41 2022 OpenVPN 2.4.6 [git:HEAD/b3a7f452206607fb] aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May 3 2022 Wed May 4 19:14:41 2022 library versions: OpenSSL 1.1.1 11 Sep 2018 Wed May 4 19:14:41 2022 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication Wed May 4 19:14:41 2022 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication Wed May 4 19:14:49 2022 TCP/UDP: Preserving recently used remote address: [AF_INET]209.14.3.200:1194 Wed May 4 19:14:49 2022 Socket Buffers: R=[1048576->1048576] S=[1048576->1048576] Wed May 4 19:14:49 2022 NOTE: setsockopt TCP_NODELAY=1 failed Wed May 4 19:14:49 2022 UDP link local: (not bound) Wed May 4 19:14:49 2022 UDP link remote: [AF_INET]209.14.3.200:1194 Wed May 4 19:14:49 2022 TLS: Initial packet from [AF_INET]209.14.3.200:1194, sid=02821386 53542aca Wed May 4 19:14:50 2022 VERIFY OK: depth=1, CN=CloudVPN Prod CA Wed May 4 19:14:50 2022 VERIFY KU OK Wed May 4 19:14:50 2022 Validating certificate extended key usage Wed May 4 19:14:50 2022 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Wed May 4 19:14:50 2022 VERIFY EKU OK Wed May 4 19:14:50 2022 VERIFY OK: depth=0, CN=br-gru-dc2-b1.cloud.openvpn.net Wed May 4 19:14:50 2022 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA Wed May 4 19:14:50 2022 [br-gru-dc2-b1.cloud.openvpn.net] Peer Connection Initiated with [AF_INET]209.14.3.200:1194 Wed May 4 19:14:51 2022 SENT CONTROL [br-gru-dc2-b1.cloud.openvpn.net]: 'PUSH_REQUEST' (status=1) Wed May 4 19:14:51 2022 PUSH: Received control message: 'PUSH_REPLY,route-gateway 100.96.1.33,ifconfig 100.96.1.34 255.255.255.240,ifconfig-ipv6 fd:0:0:8102::2/64 fd:0:0:8102::1,client-ip 200.173.248.124,ping 8,ping-restart 40,reneg-sec 3600,cipher AES-256-GCM,compress stub-v2,peer-id 71,topology subnet,explicit-exit-notify,remote-cache-lifetime 86400,block-outside-dns,route 100.96.0.0 255.224.0.0,route-ipv6 fd:0:0:8000::/49,route 100.80.0.0 255.240.0.0,route-ipv6 fd:0:0:4000::/50,dhcp-option DNS 100.96.1.33,auth-tokenSESS_ID,auth-token-user b25lc29sdmUvY29ubmVjdG9yL2I5YzdiMDVhLTY2ODUtNDNlMS05NTU5LTFkNTdhZWFjYzM4Nl9kY2M3ODY2Ny1hNDFkLTRiNWYtYWE1Ni02MGEwZjE3NzNiYjI=' Wed May 4 19:14:51 2022 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:4: client-ip (2.4.6) Wed May 4 19:14:51 2022 Options error: option 'reneg-sec' cannot be used in this context ([PUSH-OPTIONS]) Wed May 4 19:14:51 2022 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:13: remote-cache-lifetime (2.4.6) Wed May 4 19:14:51 2022 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:14: block-outside-dns (2.4.6) Wed May 4 19:14:51 2022 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:21: auth-token-user (2.4.6) Wed May 4 19:14:51 2022 OPTIONS IMPORT: timers and/or timeouts modified Wed May 4 19:14:51 2022 OPTIONS IMPORT: explicit notify parm(s) modified Wed May 4 19:14:51 2022 OPTIONS IMPORT: compression parms modified Wed May 4 19:14:51 2022 OPTIONS IMPORT: --ifconfig/up options modified Wed May 4 19:14:51 2022 OPTIONS IMPORT: route options modified Wed May 4 19:14:51 2022 OPTIONS IMPORT: route-related options modified Wed May 4 19:14:51 2022 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Wed May 4 19:14:51 2022 OPTIONS IMPORT: peer-id set Wed May 4 19:14:51 2022 OPTIONS IMPORT: adjusting link_mtu to 1624 Wed May 4 19:14:51 2022 OPTIONS IMPORT: data channel crypto options modified Wed May 4 19:14:51 2022 Data Channel: using negotiated cipher 'AES-256-GCM' Wed May 4 19:14:51 2022 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed May 4 19:14:51 2022 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed May 4 19:14:51 2022 ROUTE_GATEWAY 10.46.46.117/255.255.255.248 IFACE=wwan0 HWADDR=00:00:00:00:00:00 Wed May 4 19:14:51 2022 GDG6: remote_host_ipv6=n/a Wed May 4 19:14:51 2022 ROUTE6_GATEWAY fe80::6802:b8ff:fede:bb0a IFACE=wlan0 Wed May 4 19:14:51 2022 TUN/TAP device tun0 opened Wed May 4 19:14:51 2022 TUN/TAP TX queue length set to 100 Wed May 4 19:14:51 2022 do_ifconfig, tt->did_ifconfig_ipv6_setup=1 Wed May 4 19:14:51 2022 /sbin/ifconfig tun0 100.96.1.34 netmask 255.255.255.240 mtu 1500 broadcast 100.96.1.47 Wed May 4 19:14:51 2022 /sbin/ifconfig tun0 add fd:0:0:8102::2/64 Wed May 4 19:14:51 2022 /sbin/route add -net 100.96.0.0 netmask 255.224.0.0 gw 100.96.1.33 Wed May 4 19:14:51 2022 /sbin/route add -net 100.80.0.0 netmask 255.240.0.0 gw 100.96.1.33 Wed May 4 19:14:51 2022 add_route_ipv6(fd:0:0:8000::/49 -> fd:0:0:8102::1 metric -1) dev tun0 Wed May 4 19:14:51 2022 /sbin/route -A inet6 add fd:0:0:8000::/49 dev tun0 Wed May 4 19:14:51 2022 add_route_ipv6(fd:0:0:4000::/50 -> fd:0:0:8102::1 metric -1) dev tun0 Wed May 4 19:14:51 2022 /sbin/route -A inet6 add fd:0:0:4000::/50 dev tun0 Wed May 4 19:14:51 2022 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Wed May 4 19:14:51 2022 Initialization Sequence Completed ``` ## Reply by tom (ModalAI staff) · 2022-05-04 19:20:15 UTC @Djalma-Ribeiro That looks promising! If you do an `ifconfig` in another terminal do you see a `tun0` network interface? If so then you're all connected. ## Reply by Djalma Ribeiro · 2022-05-04 19:26:45 UTC (in reply to tom) @tom ``` tun0: flags=4305 mtu 1500 inet 100.96.1.34 netmask 255.255.255.240 destination 100.96.1.34 inet6 fd:0:0:8102::2 prefixlen 64 scopeid 0x0 inet6 fe80::da89:cbe9:b217:1ed7 prefixlen 64 scopeid 0x20 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 7 bytes 336 (336.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ``` But shouldn't I see the drone in the device list on the OpenVPN website? ## Reply by Djalma Ribeiro · 2022-05-04 19:30:48 UTC What else do I need to do to complete the OpenVPN setup? Do I need to send any certificate for the drone? I also couldn't find how to connect the QGC to the drone using VPN. How to find the address to use etc. ## Reply by tom (ModalAI staff) · 2022-05-04 19:34:37 UTC @Djalma-Ribeiro So the `.ovpn` file you used is the certificate that your drone is now using to connect to the VPN. You will also need to connect to the VPN with a different certificate using your ground control station that is running QGC. ## Reply by tom (ModalAI staff) · 2022-05-04 19:37:21 UTC @Djalma-Ribeiro By looking at the `tun0` interface you can see that the IP of your drone on the VPN is now `100.96.1.34` When you connect using your ground control station / PC you will also receive an IP there and those are the IPs you will use to communicate via. the VPN server ## Reply by Djalma Ribeiro · 2022-05-04 19:46:32 UTC (in reply to tom) @tom ![Captura de tela 2022-05-04 154616.png](https://forum.modalai.com/assets/uploads/files/1651693586882-captura-de-tela-2022-05-04-154616.png) ## Reply by Djalma Ribeiro · 2022-05-04 19:49:03 UTC (in reply to tom) @tom Is this not my computer's ip?![Captura de tela 2022-05-04 154832.png](https://forum.modalai.com/assets/uploads/files/1651693741347-captura-de-tela-2022-05-04-154832.png) ## Reply by tom (ModalAI staff) · 2022-05-04 19:55:32 UTC @Djalma-Ribeiro The fact that the IP is the same on that OpenVPN screenshot makes me think that you're attempting to use the same key file here as you are on your drone. If that's true, it won't work and the devices will keep kicking each other off the network. You need to use a unique key for each device. The first test before you try to connect to QGC would be to connect both devices to the VPN with their unique keys and then attempt to ping from the drone to your pc or from pc to drone. That way you can ensure the two can communicate with each other before you try getting PX4 / QGC involved. Once you have the pinging working, you can set the IP of the ground station on your drone in `/etc/modalai/qgc-ip.cfg`(file name may be slightly different) ## Reply by Djalma Ribeiro · 2022-05-04 20:50:47 UTC Now I understand a little more! By the way, thank you very much for your help. I have both the pc and the drone online on OpenVPN: ![Captura de tela 2022-05-04 164903.png](https://forum.modalai.com/assets/uploads/files/1651697347628-captura-de-tela-2022-05-04-164903.png) But neither can find the other by ping. Is there anything else I'm forgetting? ## Reply by tom (ModalAI staff) · 2022-05-04 20:54:29 UTC @Djalma-Ribeiro Are you using a windows machine? All of our devices use Ubuntu 18.04 so I don't have much experience with it. However on Windows, I know that some of our customers have had to disable all their firewalls in order to allow the traffic to come through. ## Reply by Djalma Ribeiro · 2022-05-04 21:26:00 UTC (in reply to tom) @tom I managed to make the ping work by putting the drone in host and the pc in network. Do I have to use UDP or TCP to connect to the QGC? ## Reply by tom (ModalAI staff) · 2022-05-04 21:34:45 UTC @Djalma-Ribeiro By default it'll use UDP. See this page for the next steps: https://docs.modalai.com/Qualcomm-Flight-RB5-user-guide-px4/ You will have to modify the `rb5-net-check` service and change the line `ExecStart=/usr/bin/rb5-net-check wlan0 192.168` to `ExecStart=/usr/bin/rb5-net-check tun0 100.96` in order to tell the drone to wait for the VPN network interface to come up before sending out PX4 packets. Then you will have to modify the previously mentioned `/etc/modalai/qgc-ip.cfg` and adding the IP of your PC on the VPN in order to tell PX4 where to send packets. You can also look at : `/etc/modalai/full-m0052.config` in order to see the PX4 startup config ## Reply by Djalma Ribeiro · 2022-05-04 22:03:44 UTC (in reply to tom) @tom I didn't find the file /etc/modalai/qgc-ip.cfg ## Reply by tom (ModalAI staff) · 2022-05-04 22:12:50 UTC @Djalma-Ribeiro Okay you may have a slightly older version of the SDK. Go ahead and download the latest SDK from: https://developer.modalai.com/asset/4 ![8fda22a7-4c14-47e3-b414-06a3f6e07924-image.png](https://forum.modalai.com/assets/uploads/files/1651702276549-8fda22a7-4c14-47e3-b414-06a3f6e07924-image.png) and then follow the instructions here to install: https://docs.modalai.com/Qualcomm-Flight-RB5-sdk-installation/ This way we know you're using the latest SDK. This qgc-ip file was added in a later release ## Reply by Djalma Ribeiro · 2022-05-04 22:50:54 UTC (in reply to tom) @tom :cry: ``` root@qrb5165-rb5:/home/rb5-flight-sdk-1.1.3# ./update-sdk.sh bash: ./update-sdk.sh: Permission denied ``` ## Reply by tom (ModalAI staff) · 2022-05-04 22:55:08 UTC @Djalma-Ribeiro Looks like the permissions got lost somewhere along the way, you can use `chmod +x update-sdk.sh` to make it executable, then try again ## Reply by Djalma Ribeiro · 2022-05-05 00:09:20 UTC (in reply to tom) @tom you are the best! thanks ## Reply by Djalma Ribeiro · 2022-05-05 01:06:44 UTC (in reply to Djalma Ribeiro) @tom Well, I managed to update, redid the settings and he is connected to the internet. But I still can't connect the QGC. I didn't understand one thing. Why the drone and the pc are online in the "Connectors" of "Networks" but both can't find each other by ping? You can only ping if one of them is a Host Connector and the other is a Networks Connector. I believe it is not Firewall because I have already disabled it. Any idea? ## Reply by tom (ModalAI staff) · 2022-05-05 17:30:13 UTC @Djalma-Ribeiro I have no experience with having an OpenVPN online account and hosting through there so I can't provide any info on any of those settings. We host our own VPN servers using Google Cloud. That doesn't mean you can't do what you're doing, I just have no experience in that area. You might get better answers to those questions on the OpenVPN forum (https://forums.openvpn.net/) It's possible you have to configure the server's firewall as well to allow traffic on the ports that PX4 uses but that's just a guess ## Reply by Djalma Ribeiro · 2022-05-06 16:16:42 UTC (in reply to tom) @tom Is there an easier way to connect the QGC to the drone? Even if on each connection I need to manually inform the ips. I need to make the drone connect via LTE/5G urgently. ## Reply by tom (ModalAI staff) · 2022-05-06 18:06:43 UTC @Djalma-Ribeiro We usually recommend just connecting over WiFi before jumping into cellular + VPN. Have you done that yet to familiarize yourself with the process of connecting to QGC? ## Reply by Djalma Ribeiro · 2022-05-06 18:23:32 UTC (in reply to tom) @tom wifi yes ## Reply by tom (ModalAI staff) · 2022-05-06 18:29:49 UTC @Djalma-Ribeiro As long as you have your VPN set up correctly it should be the exact same idea. The only change is that you will have to specify the IP of your ground station in the qgc-ip file. I can't help too much with the OpenVPN side of things other than what is in our docs. ## Reply by Djalma Ribeiro · 2022-05-11 18:16:16 UTC (in reply to tom) @tom how do i update openvpn in drone? ## Reply by tom (ModalAI staff) · 2022-05-12 16:56:55 UTC @Djalma-Ribeiro RB5 is running Ubuntu 18.04, so any installation / updating instructions for Ubuntu 18 should also be applicable to RB5 ## Reply by Djalma Ribeiro · 2022-05-30 19:33:51 UTC I was able to configure the VPN using this video: https://www.youtube.com/watch?v=IsyNtovozVU How do I make the drone auto-initialize the vpn? ## Reply by tom (ModalAI staff) · 2022-05-31 18:34:31 UTC @Djalma-Ribeiro You can create a systemd service file and enable it to run on boot and have it execute the OpenVPN connection command. Here is an example on how we have used it in the past on a VOXL: ``` [Unit] After=voxl-time-sync.service Requires=voxl-time-sync.service [Service] Type=forking ExecStartPre=/bin/sleep 2 ExecStart=/usr/sbin/openvpn --script-security 2 --daemon --config /etc/openvpn/KEY_FILE [Install] WantedBy=default.target ``` Won't be exactly the same as above but that's the general idea.