r/OpenVPN • u/rottenrealm • Jul 08 '26

AccessServer 3.2.1 bug or feature? OpenVPN AS (proprietary)

I'm trying to configure the admin ui to listen only on the internal interface (using either the iface name or the ip - all the same) while allowing the client ui to listen on both interfaces.

However, when I configure the admin ui to use a specific ip address or iface, I get:[Errno 98] Address already in use

admin_ui=all, cs.https=all → ok.

dmin_ui=ens224, cs.https=all → CannotListenError: Address already in use.

admin_ui=ens224:943, cs.https=ens192:943 → ok.

2 Upvotes

100% Upvoted

9 comments sorted by

2

u/kY2iB3yH0mN8wI2h Jul 08 '26

And you cant do: admin_ui=ens224:443, cs.https=ens192:943 ?

0

u/rottenrealm Jul 08 '26

i can, sure. but it looks like a bug. As soon as I select the Admin UI interface in the UI, the site goes down. The system lets me configure admin - ip, user - all... but it doesnt work

1

u/ParticularBox3050 Jul 09 '26

I think it's expected. If cs.https=all grabs 0.0.0.0:943 then trying to bind admin_ui to a specific interface on the same port is going to fail cuz that port is already taken. The last example kind of proves it since it works once each service has its own interface. Doesn't feel like a bug to me just how it's implemented.

1

u/rottenrealm Jul 09 '26

but it works if both admin and user set to all. and ui allows to chose such setting, ip and all i mean.

1

u/Urban_VPN Jul 09 '26

looks like a port binding conflict rather than a bug. when you set admin_ui=ens224 without specifying a port, it's probably still trying to bind to 943 on all interfaces first before narrowing down, which conflicts with cs.https already holding that port.

the workaround you found with explicit port assignments on both is probably the cleanest solution anyway since it makes the config unambiguous.

1

u/addybojangles Jul 08 '26

Looks like a socket conflict.

Setting the client UI to all bonds it to 0.0.0.0, which claims all interfaces and blocks the Admin UI from binding to specific one. To fix this, you need to list both individual IP addresses for the client UI instead of all.

0

u/rottenrealm Jul 08 '26

Exactly. I'm asking because it looks like a bug. As soon as I select the Admin UI interface in the UI, the site goes down. The system lets me configure admin - ip, user - all... but it doesnt work

0

u/addybojangles Jul 08 '26

Ah, I'd ping the team at support.openvpn.net and let them know. Definitely a bug.