The VPN Client doesn't work on Fedora with SELinux installed. When trying to set up a VPN connection you will receive error "OpenVPN: exiting due to fatal error. (744)"

SELinux is likely blocking the connection attempt because it is set to "enforcing"-mode. You can verify this by temporarily running SELinux in "permissive"-mode and testing if the VPN connection then works.

1. Verify that SELinux is running in "enforcing"-mode.

   sestatus

3. Change the mode to "permissive"-mode.

   sudo setenforce 0

3. Test the VPN connection and verify that works now.
4. Change the mode back to "enforcing"-mode.

   sudo setenforce 1

Additionally, you can see this in the journalctl and audit log.

<date/time> <system name> audit[<PID>]: AVC avc:  denied  { read write } for  pid=15921 comm="openvpn" name="tun" dev="devtmpfs" ino=627 scontext=system_u:system_r:init_t:s0 tcon>
<date/time> <system name> vpn_client[<PID>]: [YYYY-MM-DD HH:mm:ss] [0x00007f7e7188e6c0] [info] [process_monitor] [openvpn] YYYY-MM-DD HH:mm:ss ERROR: Cannot open TUN/TAP de>
<date/time> <system name> vpn_client[<PID>]: [YYYY-MM-DD HH:mm:ss] [0x00007f7e7188e6c0] [info] [process_monitor] [openvpn] YYYY-MM-DD HH:mm:ss Exiting due to fatal error

sudo grep openvpn /var/log/audit/audit.log

type=AVC msg=audit(1772537926.475:283): avc:  denied  { read write } for  pid=15921 comm="openvpn" name="tun" dev="devtmpfs" ino=627 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tun_tap_device_t:s0 tclass=chr_file permissive=0

1. Create an SELinux policy to allow the VPN connection, based on the information from the above audit log. The following command will create a rule file (myopenvpn.te) and a policy file (myopenvpn.pp).

   sudo grep openvpn /var/log/audit/audit.log | audit2allow -M myopenvpn

   Click below to view the content of the rule file.

   myopenvpn.te

   module myopenvpn 1.0;
   
   require {
       type init_t;
       type tun_tap_device_t;
       class chr_file { ioctl open read write };
       class tun_socket create;
   }
   
   #============= init_t ==============
   allow init_t self:tun_socket create;
   allow init_t tun_tap_device_t:chr_file { ioctl open read write };

2. Apply the policy.

   sudo semodule -i myopenvpn.pp