server.conf
port 1194
proto udp
dev tun
daemon
topology subnet
ca ./ca.crt
cert ./server.crt
key ./server.key
dh ./dh1024.pem
server 10.10.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ./ccd/
keepalive 10 120
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
status ./openvpn-status.log
log-append ./openvpn.log
verb 3
script-security 2
client-connect ./client-connect.sh
client-disconnect ./client-disconnect.sh
writepid /var/run/openvpnd.pid
_______________
client.conf
client
dev tun
proto udp
resolv-retry infinite
daemon
user nobody
group nobody
persist-key
persist-tun
ca ./ca.crt
cert ./slave.crt
key ./slave.key
ns-cert-type server
comp-lzo
status ./openvpn-status.log
log-append ./openvpn.log
verb 3
writepid /var/run/openvpnd.pid
explicit-exit-notify 3
_________________
i got my problem solved here:
https://forums.openvpn.net/topic15206.html#p38755
i added "nobind" configuration parameter to client.conf, and now everytime openvpn on client starts with a different port and server considers this as a new connection. So, even if the event of client openvpn shutting down(SIGTERM) wasn't received by server somehow (due to network disruption or something else, its udp afterall.), next time when it connects to server, server'll consider this as a new connection and client-connect script will be executed. 🙂
But, solution to one problem led to another,
Our client-connect script takes a little too much time [isn't avoidable], such that when client is getting connected, and client-connect script is getting executed, it crosses 120 sec.
and after sigusr1 singnal, openvpn on client gets soft reboot [due to nobind, it starts with a new port, leading to a new connection rather continuation of previous one]. So, while one client-connect script is in progress, after soft reboot [due to nobind it'll be a new connection], another client-connect script gets called. And, repeating the same multiple client-connect sessions are there now.
1.) How to avoid openvpn sigusr1 soft reboot on client until connection establishes [independent from execution time of client-connect script]. And, we want to keep keepalive 10 120.
P.S. - We don't have any --up / --down scripts. Have --client-connect and --client-disconnect scripts.
2.) Or, could we have an alternative of nobind, i mean if client openvpn service goes down and even if explicit-exit-notify 3 on client, due to some reason server didn't get notified. And, when client openvpn comes up again, server MUST NOT consider this as a "new incoming session of tls". After all client openvpn got restarted, so what... server didn't get the SIGTERM, next time when client connects it [server] must know its a new connection and treat it like one.
Please help ASAP. Thanks in advance.!!!!
