Arch Linux User Repository

Please note the following requirements for AWS VPN Client:

• If you depend on DNS servers from VPN you need to have a running systemd-resolved.service. Please ensure it does not conflict with any other DNS resolver service or configuration you may use. sudo systemctl --now enable systemd-resolved.service

• You have to enable and start the awsvpnclient.service after installation: sudo systemctl --now enable awsvpnclient

For troubelshooting its worth checking first the logs:

/home/$USER/.config/AWSVPNClient/
/var/log/aws-vpn-client/$USER/

See also the official docs: https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-linux.html

If you face any other problem please check the troubleshooting guide (DNS issues): https://docs.aws.amazon.com/vpn/latest/clientvpn-user/linux-troubleshooting.html#aws-provided-client

@spurgelaurels maybe this applies to you. I found out that the configure-dns script didn't see the ip binary, therefore there were exit code 127 logs in configure-dns-up.log. More in https://gist.github.com/miguelgmalpha/5c9e78d16312d156b0ec1d1c1bb09c1c?permalink_comment_id=4215154

@spurgelaurels I see the same problem when trying to run this in Fedora 36 https://gist.github.com/miguelgmalpha/5c9e78d16312d156b0ec1d1c1bb09c1c?permalink_comment_id=4212386#gistcomment-4212386.

Fedora is running in a VM. This doesn't happen in my Arch host.

Running 3.1.0 now, and receiving the following error after it seems to accept my AUTH and start setting up the tunnel interfaces:

2022-06-27 14:47:06.474 -04:00 [DBG] >LOG:1656355626,F,WARNING: Failed running command (--up/--down): external program exited with error status: 1

EDIT: At some point in my troubleshooting I guessed that the following needn't be run in my case since it wasn't fixing previous problems:

sudo systemctl --now enable systemd-resolved.service

Turns out this is still needed, and short of a proper error message in a main log, I found this line in /var/log/awsvpnclient/configure-dns-up.log:

 busctl command exit code: 1, output: Call failed: Unit dbus-org.freedesktop.resolve1.service not found

AWS released a new version for the client 3.1.0 I've tested locally to build the package with this update and it works great. Don't forget to restart the awsvpnclient systemd service after upgrade

$ git -C ~/.cache/aurutils/sync/awsvpnclient diff
diff --git a/PKGBUILD b/PKGBUILD
index 9a9ec78..5e44cbd 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Richard Hillmann <richie at project0 dot de>
 pkgname=awsvpnclient
-pkgver=3.0.0
-pkgrel=3
+pkgver=3.1.0
+pkgrel=1
 pkgdesc="AWS VPN Client"
 arch=('x86_64')
 license=('custom')
@@ -11,7 +11,7 @@ source=(
   'awsvpnclient.desktop.patch'
   'awsvpnclient.runtimeconfig.json.patch'
 )
-sha512sums=('acbe9a5fd0a04b18effc35993d4809b451e717eb507ff31a5f79355463d80b488e3fbd149ad781396bc3e5182346302932d69e105e6341b60ce167f8c90044ef'
+sha512sums=('d409002fcbd993adf375a2037c7f15ca284ff78f605685c15cfb6cfb9916a25260d088ac26793f3f399ff7388d2143ddd449ccaca768a8ce8040a13c3d339c81'
             '0c32ba0b81ac1123dd6123ee2f4b7573957eab76ae40708e2acfd28b15c9b1717b63450d40bddf449e088b0cf202faac466bd4d7bd79cf2a032735190b625c20'
             '1d45e50de14b9e10b6463692df63bfb4cbedfed952022c95f05bde46ece37ac1a433b76e49f255f38b1bd67c0f0f13d2d8c963051a144553c63149e6041d6603')
 depends=('xdg-utils' 'lsof')

The 3.1.0 has drive type detection mentioned in the release notes:

    Fixed issue for drive type detection.
    Improved security posture.

EDIT: used the update, works for me. Thanks!

I see with 3.x.x

ACVC.Core.OpenVpn.ReferencedFilePathInvalidException: File: /home/.../.config/AWSVPNClient/OpenVpnConfigs/current_connection.txt may be a path to an unsupported drive type, which is not allowed for security reasons

This is on usual ext4fs, and/or ext4fs+ecryptfs. 1.x.x did fine.

No problem @project0 :)

@aemonge Thanks for letting me know. The profile is not required anymore, i added a patch to the runtimeconfig json file of the package.

Update: I had to patch the service daemon as well, version 3.0.0-3 seems to work now again ;-)

We now also need to add this to our ~/.profile:

export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1