Setting Up OpenVPN With Correct Startup and Runtime Permissions

Verbatim

Getting this error:

writepid fails with '/var/run/openvpn.lappy.pid': Permission denied (errno=13)

when trying to connect with OpenVPN Admin 1.9.4

Don't think its a problem with the config, but will post below; pretty sure the issue is permissions (adding devices + networking would need root-ish privileges)

proto udp
verb 3
dev tun
remote REDACTED
port 1194
nobind
persist-key
persist-tun
client
ca /home/REDACTED/pki/ca.crt
cert /home/REDACTED/pki/issued/daniel.crt
key /home/REDACTED/pki/private/daniel.key
tls-crypt /home/REDACTED/pki/ta.key 1
remote-cert-tls server

ericbsd

@Verbatim, how do you start OpenVPN?

Verbatim

@ericbsd , thanks

Verbatim

thought the gui would start it; no, its done through rc.conf

ericbsd

Is the folder where the files are set to the right permissions?

ericbsd

Oh, and do you have more logs and longer error messages?

ericbsd

Are you starting the service as root using sudo?

Verbatim

I've never setup openvpn on a client nx machine before, and don't really know what I'm doing.

Right now, the OpenVPN admin gui gives the following error output when hitting the "connect" button:

2026-04-18 17:38:21 Note: --cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
Options error: --writepid fails with '/var/run/openvpn.lappy.pid': Permission denied (errno=13)
Options error: --status fails with '/var/run/openvpn.lappy.status': Permission denied (errno=13)
Options error: Please correct these errors.
Use --help for more information.

Verbatim

However, that's with the openvpn rc service running, so don't think they are talking to each other; I symlinked the lappy.conf file to the name of the file the openvpn service was expecting (openvpn.conf).

Verbatim

ls -al /usr/local/etc/openvpn/
total 14
drwxrwxrwx 2 root wheel 4 Apr 16 19:45 ./
drwxr-xr-x 49 root wheel 84 Mar 18 09:39 ../
-rw-r--r-- 1 daniel wheel 334 Apr 6 15:52 lappy.conf
lrwxr-xr-x 1 root wheel 33 Apr 16 19:45 openvpn.conf@ -> /usr/local/etc/openvpn/lappy.conf

Verbatim

I started the service by editing /etc/rc.conf - added openvpn_enable="YES"

Then su to root, and ran: # service openvpn start

ericbsd

In normal time, /usr/local/etc/openvpn should be read-only for root and wheel. I never use the GUI. I only use the service.

If you use a GUI, it will not have permission to reach /var/run/openvpn.lappy.pid with a normal user. You need to be root.

Verbatim

It might actually be working properly right now, not sure - on my home router, something was set to redirect requests for the VPN network to the vpn gateway ip, and I'm having trouble remembering where that is to turn it off, haha.

Good way to test would be to use the ghostbsd system on a separate network, hotspot, etc; just haven't done it yet

Verbatim

\Guess I was just hoping the gui app would handle all of the complication of setup for me, like windows world, haha. Its cool though, running the service without gui works fine.

Thanks for the assist!