Sshd not starting on openvpn network with systemd

[danez]

Hello,

I have a new server since some months and this was the first time I setup gentoo with systemd. Most stuff worked, some stuff still doesn't work reliable (like network interface eth0 cannot be renamed to en* on boot because busy) but for most things I found workarounds.

One thing that I haven't figured out yet is how to reliable start sshd after openvpn link is up and sshd can bind to the vpn network address. This worked fine on my old server with openrc but with systemd there seem to be race timing conditions as it works 3 or 4 times out of 10.

So far I already added this systemd unit extension, but that doesn't seem to help much as even though the network interface is up it seems not to have an ip assigned yet.
/etc/systemd/system/sshd.service.d/00openvpn.conf

[danez]

Okay seems sometimes writing stuff down helps also finding new ways. I think I solved it now, will test further though. Here is what I have done:

Created new service

/etc/systemd/system/openvpn-online.service

[mike155]

Another solution would be to start sshd independently of openvpn and NOT to set ListenAdress in sshd_config, so that sshd listens on all local addresses.

[danez]

[szatox]

Danez. you can make it listen on all addresses and deny direct access on firewall.
Usually you set INPUT policy to DROP, and then allow traffic you want. E.g. you can decide to accept stuff coming in via tap0 or whatever interface openvpn creates for you and drop the rest.