Home / server / Questions / 776107
In Process
mjoao
Asked: 2016-05-12 03:57:58 +0800 CST

Linux vpnc - How to define a specific tunX number in vpnc

  • 772

I need to start multiple vpnc tunnels and define a different static route for each of individually after setup.

To do so I created a script that will run after each connection (tunX) goes up.

However if one or more tunnels goes down and I need to restart those particular connection I’ll lose the correct attribution order for each client and my script won’t work as intended, effectively locking me out of the box.

Example: I need to delete and add the following routes for client_b in tun1 because injected routes override my internal networks.

ip route del 0.0.0.0/0 dev tun1 # this route must be deleted because it overrides my GW.
ip route del 192.168.0.0/16 dev tun1 # this route must be deleted because it overrides internal net.
ip route add 192.168.88.0/24 via 123.123.123.123 dev tun1 # Manually added subnet that I need to have access to
ip route add 0.0.0.0/0 via 192.168.40.1 dev eth0 # My internal network is 192.168.40.0/24

As such, whenever I start a new vpnc connection I’ll get a tunnel number starting with tun0, then tun1, tun2 and so on.

If however one tunnel goes down and I need to restart it, I’ll get a tunX where X is not in order anymore.

Example: Initially when I connect these clients sequentially I’ll get a sequential tunX number for each client.

sudo vpnc client_a --local-port 0 # It will be available on tun0
sudo vpnc client_b --local-port 0 # It will be available on tun1
sudo vpnc client_c --local-port 0 # It will be available on tun2
sudo vpnc client_d --local-port 0 # It will be available on tun3

Please note: I need to delete undesired routes in each tunnel and define personalized routes for each one individually because each one has its own route and corresponding endpoint.

Killing all connections at once and start them all sequentially is not an option.

So my question is: How can I statically define client_a to always make use tun0, client_b to always use tun1 and so on?

vpn linux centos7 tunnel

1 Answers

  1. Just in case someone comes across the same issue, here's the solution I've made.

    #!/bin/bash
# Run script as # nohup ./vpn-monitor.sh /dev/null 2>&1 &
# mjoao

################### Start functions ###################

vpn_clientA(){

vpnName="clientA"
endpoint="10.23.23.51"
endpoint2="10.23.25.55"

count=$( ping -c 3 $endpoint | grep icmp* | wc -l )
count2=$( ping -c 3 $endpoint2 | grep icmp* | wc -l )

if [ $count -eq 0 -a $count2 -eq 0 ]
    then
    # All pings have failed!!!
    echo "Ping FAILED $(date)" >> /var/log/vpnc/$vpnName.log

    # Sending Email...
    echo "Ping for $endpoint FAILED! More info /var/log/vpnc/$vpnName.log " | mail -s "VPN $vpnName failed " [email protected]

    # Restart connection
    /root/vpn_clientA.sh >> /var/log/vpnc/$vpnName.log &

else
    echo "Ping replied $(date)" >> /var/log/vpnc/$vpnName.log
fi
}


vpn_clientB(){

vpnName="clientB"
endpoint="192.168.10.11"
endpoint2="192.168.10.13"

count=$( ping -c 3 $endpoint | grep icmp* | wc -l )
count2=$( ping -c 3 $endpoint2 | grep icmp* | wc -l )

if [ $count -eq 0 -a $count2 -eq 0 ]
    then
    # All pings have failed!!!
    echo "Ping FAILED $(date)" >> /var/log/vpnc/$vpnName.log

    # Sending Email
    echo "Ping for $endpoint FAILED! More info /var/log/vpnc/$vpnName.log " | mail -s "VPN $vpnName failed " [email protected]

    # Restart connection
    /root/vpn_clientB.sh >> /var/log/vpnc/$vpnName.log &

else
    echo "Ping replied $(date)" >> /var/log/vpnc/$vpnName.log
fi
}


vpn_clientC(){

vpnName="clientC"
endpoint="10.10.10.78"
endpoint2="10.10.10.198"

count=$( ping -c 3 $endpoint | grep icmp* | wc -l )
count2=$( ping -c 3 $endpoint2 | grep icmp* | wc -l )

if [ $count -eq 0 -a $count2 -eq 0 ]
    then
    # All pings have failed!!!
    echo "Ping FAILED $(date)" >> /var/log/vpnc/$vpnName.log

    # Sending Email
    echo "Ping for $endpoint FAILED! More info /var/log/vpnc/$vpnName.log " | mail -s "VPN $vpnName failed " [email protected]

    # Restart Connection
    /root/vpn_clientC.sh >> /var/log/vpnc/$vpnName.log &

else
    echo "Ping replied $(date)" >> /var/log/vpnc/$vpnName.log
fi
}
################### Functions End ###################



while : # Infinite cycle 

do
# Call functions every 30 seconds
vpn_clientA
vpn_clientB
vpn_clientC
sleep 30

done

    Edited for spelling and clarity.

    • 0