I'm trying to add records to DNS as clients connect and disconnect via OpenVPN. I planned originally to use the learn-address script for this, but later found that upon disconnection the common_name environment variable is not available. I then looked to the client-connect and client-disconnect scripts since the common_name and DHCP address should be exposed at this point (at least according to the man page for version 2.3). [code]rpm -qi openvpn egrep 'Version|Release' Version : 2.2.0 Vendor: Dag Apt Repository, http://dag.wieers.com/apt/ Release : 3.el6.rf Build Date: Sun 05 Jun 2011 05:04:41 PM CDT [/code] Out of curiousity I added [code]learn-address /etc/openvpn/scripts/test.sh client-connect /etc/openvpn/scripts/test.sh client-disconnect /etc/openvpn/scripts/test.sh[/code] (test.sh below) [code] #!/bin/bash #test.sh echo $# ARGUMENTS echo ARGUMENTS 1=$1 2=$2 3=$3 4=$4 [/code] to my config file to simply find out if these variables are available and here is what was returned upon client connection for the client-connect script: [i]1 ARGUMENTS ARGUMENTS 1=/tmp/openvpn_cc_0558b5a5f369c070253197c45570aadf.tmp 2= 3= 4=[/i] Here is what was returned upon client connection for the learn-address script: [i]3 ARGUMENTS ARGUMENTS 1=add 2=172.16.128.2 3=pancf51 4=[/i] Server config file [code] # General networking dev tun proto udp persist-tun persist-key keepalive 10 60 server 172.16.128.0 255.255.255.0 topology subnet # Push options push "route 172.16.0.0 255.255.252.0" push "dhcp-options DNS 172.16.2.5" push redirect-gateway def1 #Redirect client traffic to use VPN # Scripting script-security 2 #default is 1 which doesn't allow user-defined scripts learn-address "/etc/openvpn/scripts/test.sh" client-connect "/etc/openvpn/scripts/test.sh" client-disconnect "/etc/openvpn/scripts/test.sh" # Local user openvpn group openvpn daemon comp-lzo management 127.0.0.1 6001 # Limits max-clients 10 # Security tls-server dh easy-rsa/keys/dh2048.pem ca easy-rsa/keys/ca.crt cert easy-rsa/keys/VPN-Server.crt key easy-rsa/keys/VPN-Server.key crl-verify easy-rsa/keys/revoke-test.pem # Tracking log /var/log/openvpn/openvpn.log status /var/log/openvpn/status.log 2 status-version 1 verb 5 #0 - 11 (most verbose = 11) [/code] Client config file [code]float remote somewhere.net dev tun proto udp tls-client topology subnet pull comp-lzo verb 3 ca ../keys/ca.crt cert ../keys/pancf51.crt key ../keys/pancf51.key explicit-exit-notify[/code] Any idea why the environment variables are not available to the client-connect script? Thanks, Gary

Client-connect, client-disconnect, and learn-address scripts

ghjeffeii

I'm trying to add records to DNS as clients connect and disconnect via OpenVPN. I planned originally to use the learn-address script for this, but later found that upon disconnection the common_name environment variable is not available. I then looked to the client-connect and client-disconnect scripts since the common_name and DHCP address should be exposed at this point (at least according to the man page for version 2.3).

rpm -qi openvpn egrep 'Version|Release'
Version     : 2.2.0                             Vendor: Dag Apt Repository, http://dag.wieers.com/apt/
Release     : 3.el6.rf                      Build Date: Sun 05 Jun 2011 05:04:41 PM CDT

Out of curiousity I added

learn-address /etc/openvpn/scripts/test.sh
client-connect /etc/openvpn/scripts/test.sh
client-disconnect /etc/openvpn/scripts/test.sh

(test.sh below)

#!/bin/bash
#test.sh
echo $# ARGUMENTS
echo ARGUMENTS 1=$1 2=$2 3=$3 4=$4

to my config file to simply find out if these variables are available and here is what was returned upon client connection for the client-connect script:
1 ARGUMENTS
ARGUMENTS 1=/tmp/openvpn_cc_0558b5a5f369c070253197c45570aadf.tmp 2= 3= 4=

Here is what was returned upon client connection for the learn-address script:
3 ARGUMENTS
ARGUMENTS 1=add 2=172.16.128.2 3=pancf51 4=

Server config file

# General networking
dev tun
proto udp
persist-tun
persist-key
keepalive 10 60
server 172.16.128.0 255.255.255.0
topology subnet

# Push options
push "route 172.16.0.0 255.255.252.0"
push "dhcp-options DNS 172.16.2.5"
push redirect-gateway def1 #Redirect client traffic to use VPN

# Scripting
script-security 2 #default is 1 which doesn't allow user-defined scripts
learn-address "/etc/openvpn/scripts/test.sh"
client-connect "/etc/openvpn/scripts/test.sh"
client-disconnect "/etc/openvpn/scripts/test.sh"

# Local
user openvpn
group openvpn
daemon
comp-lzo
management 127.0.0.1 6001

# Limits
max-clients 10

# Security
tls-server
dh easy-rsa/keys/dh2048.pem
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/VPN-Server.crt
key easy-rsa/keys/VPN-Server.key
crl-verify easy-rsa/keys/revoke-test.pem

# Tracking
log /var/log/openvpn/openvpn.log
status /var/log/openvpn/status.log 2
status-version 1
verb 5 #0 - 11 (most verbose = 11)

Client config file

float
remote somewhere.net
dev tun
proto udp
tls-client
topology subnet
pull
comp-lzo
verb 3
ca ../keys/ca.crt
cert ../keys/pancf51.crt
key ../keys/pancf51.key
explicit-exit-notify

Any idea why the environment variables are not available to the client-connect script?

Thanks,

Gary

gudul

Hi Gary,

Any progess with your project? I am in the same situation and would appreciate hints if you have any.

Thx.

ghjeffeii

I found this script online and modified it to suite my needs.

[root@fw1 ~]# cat /etc/openvpn/scripts/learn-address.sh
#!/bin/bash
# For A Record:         <action> <hostname> <ttl> <type> <address>
# For PTR Record:       <action> <revaddr> <ttl> <type> <fqdn>
# $1=operation $2=address $3=common_name

# VARIABLES
dnsserver=172.16.1.1
masterzone=maricopa.local
fwdzone=vpn.$masterzone
revzone=16.172.in-addr.arpa
ttl=360
op=$1
addr=$2
revaddr=`echo $addr | sed -re 's:([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+):\4.\3.\2.\1.in-addr.arpa:'`
cn=$3
fqdn=$cn.$fwdzone
dir=/etc/openvpn/scripts/dns
addfile=$dir/add_$addr
delfile=$dir/del_$addr

echo op=$op addr=$addr cn=$3 fqdn=$fqdn

addRecord() {
        cat > $addfile << EOF
server $dnsserver
zone $masterzone
update delete $fqdn a
update add $fqdn $ttl a $addr
send
zone $revzone
update delete $revaddr ptr
update add $revaddr $ttl ptr $fqdn
send
EOF

        cat > $delfile << EOF
server $dnsserver
zone $masterzone
update delete $fqdn a
send
zone $revzone
update delete $revaddr ptr
send
EOF

        nsupdate -v $addfile
        rm -f $addfile
}

delRecord() {
        nsupdate -v $delfile
        rm -f $delfile
}

case $op in
        add|update)
                addRecord
                ;;
        delete)
                delRecord
                ;;
        *)
                echo "Unable to handle operation $op.  Exiting" exit 1
esac

Here's the appropriate section in my openvpn.conf file:

[root@fw1 ~]# egrep 'script|learn' /etc/openvpn/openvpn.conf
script-security 2 #default is 1 which doesn't allow user-defined scripts
learn-address "/etc/openvpn/scripts/learn-address.sh"

It works but feels a little clumsy.

Gary

gudul

Thanks a lot 😃

ghjeffeii

You bet. I hope it works for you.

Gary