New in OpenVPN 2.5 is "Deferred client-connect": https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst [quote]The --client-connect option and the connect plugin API allow asynchronous/deferred return of the configuration file in the same way as the auth-plugin.[/quote] It sounded as if current implementations of client-connect would be able to take advantage of this async functionality, but that is not the case. I'm wondering if there's any examples or documentation on this. From what I can tell, it seems as if a new plugin has to be built and used: https://github.com/OpenVPN/openvpn/tree/master/sample/sample-plugins

https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/script-options.rst

Thank you! If I understand correctly, then it would look something like this: [code] if client-connect run $script in background echo 2 >> ${client_connect_deferred_file} # deferred exit 0 within $script: # do async stuff echo 1 >> ${client_connect_deferred_file} #success; client connects exit [/code] Is that right?

Read it again. a bit more carefully.

Your first script above would [i]probably[/i] work, Have you tested it yet ?

Yeah it works. Granted there's a lot of error handling that needs to be done with the pseudocode, but that's why it's not actual code lol.

If you are in the mood for experimenting the try this: https://github.com/TinCanTech/easy-tls

Thanks @TinCanTech! There's something odd I've noticed; note that the server is using duplicate-cn. Currently, the client-connect script will run some code which client-disconnect is supposed to undo. For the sake of discussion, let's say client-connect does: [code]touch /tmp/${username}_${trusted_port}.lock # code to check for active client connections for this user and remove any lock files that don't match up.[/code] and client-disconnect does: [code]rm -f /tmp/${username}_${trusted_port}.lock[/code] The issue is that sometimes the .lock file isn't removed meaning the client-disconnect script was not called. The extra code in client-connect to remove the lock files helps, but it doesn't solve the scenario in which old user sessions have yet to time out (hence considered active and file not removed); this scenario is supposed to be dealt with client-disconnect which presumable gets run after the timeout. This happens rarely (a few weeks has passed before it happened), but it's happened more than a handful of times now. Any thoughts on this?

https://community.openvpn.net/openvpn/ticket/160

I must admit, I had lost hope of figuring it out. Nice job with the troubleshooting there.

How to use Deferred client-connect

TinCanTech

If you can afford minor out-side consultation fees then I can help.

finchalex

I've read it a handful of times.

Is it that I'm missing something with "client_connect_config_file"? My reasons for not using it are it says "(optional, if per-session configuration is desired)" and I'm not entirely sure what configuration I would write to it.

Or perhaps you're referring to an issue with this line "echo 1 >> ${client_connect_deferred_file} #success; client connects", which I included because it said ""when finished, write the a 1 to this file".

Or maybe is none of those!
_________________________
custom bottled water

« Previous Page