Deeper Look Into OpenVPN

We've written a tutorial before on a simple setup of OpenVPN on a server which allows clients to connect to your server quickly and easily. For the sake of simplicity, that article omitted to mention a a whole lot of other useful settings for OpenVPN. So let's fix that!

Let's look again at our server configuration from last time:


port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
server 172.16.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 5 30
comp-lzo
persist-key
persist-tun
status openvpn-status.log 3
verb 3
script-security 3 system
max-clients 10

Let's unpack that really quick:

port 1194 designates the listen port, and we can change this port whenever we'd need it. We can also assign different ports to multiple OpenVPN server.

proto udp refers to the network protocol it's using. We could use TCP and UDP but we'll stick with UDP since it allows for better performance.

dev tun this parameter means traffic through the VPN tunnel will be routed. You could also use dev tap here which will designate the connected clients as a bridge between server and client instead.

server 172.16.0.0 255.255.255.0 the server address and the subnet mask. When setting this up, make sure you use only private network ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

comp-lzo allows use of algorhythm lzo for data compression.

max-clients 10 limit the maximum connected clients to 10.

status openvpn-status.log 3 creates a log file openvpn-status.log of client information, which will update every 3 seconds.

While these are the parameters we're using for our setup, here are a few more you might find useful:

duplicate-cn this allows multiple clients to connect to your server using the same authentication certificate. This can be useful sometimes.

client-to-client lets connected clients access other clients peer-to-peer. Without this parameter, clients only have access to the server.

crl-verify crl.pem enables checking certificates against a database of revoked certificates. Certificates that have been revoked will be rejected.

client-connect /etc/openvpn/connect.py
client-disconnect /etc/openvpn/disconnect.py designated scripts will run every time a client disconnects. We actually explain this type of script later in this article!

Revoking OpenVPN Certificates

Every sysadmin usually runs into having to check the list of connected clients, release new certificates, revoke old ones, and generally make sure that the server is accessible when it needs to be. We covered generating a new certificate in a past article, so let's go over how to revoke it.

First, we need to run a script '/etc/openvpn/easy-rsa/revoke-full' with the name of the certificate you're trying to revoke. Once done, the file crl.pem will be updated and the revoking will go into effect.

NOTICE: You must have a crl-verify parameter included in your configuration file, as otherwise the certificate will not be included in the database of revoked ones, allowing clients to use it to connect.

Seeing Connected Clients

You can check the list of connected clients inside '/etc/openvpn/openvpn-status.log'. Individual listings will looks something like this:


OpenVPN CLIENT LIST
Updated,Mon Jul 11 15:19:21 2016
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client15,147.30.234.31:64214,1136171,171517,Mon Jul 11 11:16:40 2016
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
172.18.0.74,client15,147.30.234.31:64214,Mon Jul 11 11:16:46 2016
GLOBAL STATS
Max bcast/mcast queue length,76
END

It's going to be difficult to go through entries that look like that, especially in cases where a lot of clients are connected to your server. You can make parsing this information easier by using the grep command, though it'll still be pretty cumbersome to go through.

This is where we get to using scripts. The parameters client-connect and client-disconnect let us use user scrips when clients connect to, or disconnect from, the server. Here's an example of such a script, written in Python:

connect.py:


#!/usr/bin/python
# -*- coding: utf-8 -*-
import MySQLdb
import posix

db_server = 'localhost'
db_user   = 'vpn_db'
db_pass   = 'your_password'
db_base   = 'vpn_db'

db = MySQLdb.connect(db_server, db_user, db_pass, db_base)
with db:
    c = db.cursor()
    s = "INSERT IGNORE INTO clients SET name='%s', public_ip='%s', vpn_ip='%s'" % (str(posix.environ['common_name']), str(posix.environ['trusted_ip']), str(posix.environ['ifconfig_pool_remote_ip']));
    c.execute (s)
db.close()

disconnect.py:


#!/usr/bin/python
# -*- coding: utf-8 -*-
import MySQLdb
import posix

db_server = 'localhost'
db_user   = 'vpn_db'
db_pass   = 'your_password'
db_base   = 'vpn_db'

db = MySQLdb.connect(db_server, db_user, db_pass, db_base)
with db:
    c = db.cursor()
    s = "DELETE FROM clients WHERE name='%s' AND busy = '';" % str(posix.environ['common_name'])
    c.execute (s)
db.close()

The first script inserts information on newly connected clients into a 'clients' table inside a 'vpn_db' database, while the second script deletes the entries once the clients disconnect. The table will look something like this:


+---------------------+-----------------+--------------+
| name                | public_ip       | vpn_ip       |
+---------------------+-----------------+--------------+
| client15            | 147.30.234.31   | 172.18.0.74  |
+---------------------+-----------------+--------------+

With both scripts in place, you will now have a list of currently connected clients that updates in real-time as clients connect and disconnect, as well as lists their private and external IP addresses.

This article is just one example of what you can do, and you can use the code in it or modify it based on your needs.

Monitoring an OpenVPN server usually comes down to checking port 1194's availability and the running 'openvpn' service. Check out our article on Monit setup, for more information on port monitoring. 

Hope you learned something from this article, and follow @serversuit for updates on upcoming articles in the future!

Until next time! 

July 21 2016

Add or review comments

Please leave your comment

Existing comments

Comments 20


Odil Sharipo
Hi Odile, Nice article to manage openvpn without logging to dashboard. Recently, I deployed openvpn working perfectly with LAN ..but disconnects over wifi.any clue on this?
Thanks to my father who stated to me on the topic of this blog, this webpage is really amazing. where to buy cbd oil in oklahoma where to buy cbd oil in oklahoma
Thanks to my father who stated to me on the topic of this blog, this webpage is really amazing. where to buy cbd oil in oklahoma where to buy cbd oil in oklahoma
I was reccommended this web site byy my cousin. I am not sure whether this post is written by him as nobody else know such detailed about my problem. Youu are amazing! Thanks! https://writeanessayforme.info best online essay writing service best online essay writing service https://writeanessayforme.info
I was recommended this web site by my cousin. I am not sure whether this post is written by him as nobody else know such detailed about my problem. You are amazing! Thanks! https://writeanessayforme.info best online essay writing service best online essay writing service https://writeanessayforme.info
Today, I went to the beachfront with my children. I found a sea shell and gave it too my 4 year old daughter and said "You can hear the ocean if you put this to your ear." She placed the shell to her ear and screamed. There was a hermit crab insire and it pinched herr ear. She never wants to go back! LoL I know tis is entirely offf topic but I had to tell someone! https://writemyessaybest.com last minute essay writing service last minute essay writing service https://writemyessaybest.com/
Today, I went tto the beachfront with my children. I ffound a sea shell and gave it to my 4 year old daughter and said "You can hear the ocean if you put this to your ear." Shee placed the shell to her ear and screamed. There was a hermit crab inside and it pinched her ear. She never wants to go back! LoL I know this is entirely off topic but I had to tell someone! https://writemyessaybest.com lawt minute essay writing service last minute essay writing service https://writemyessaybest.com/
Hi, i think that i saw you visited my web site thus i came to “return the favor”.I am attempting to find things to enhance my web site!I suppose its ok to use a few of your ideas!! https://essayserviceusukua.com/ custom paper writing service custom paper writing service https://essayserviceusukua.com
Hi, i think thyat i saw you visited my web site thus i came to “return the favor”.I am attempting to find things to enhance my web site!I suppolse iits ok tto use a feew oof your ideas!! https://essayserviceusukua.com/ custom paper writing service custom pawper writing service https://essayserviceusukua.com
Thank you, I have recently been looking for information about this topic for ages and yours is the best I have caame upon till now. However, what about the bottom line? Are you certain about the source? https://buyessayonlineforcheap.com/ essay phrasess sed in writing essay phrases used in writing https://buyessayonlineforcheap.com
Thank you, I have recently been looking for information about this topic for ages and yours is the best I have came upon till now. However, what about tthe bottom line? Are you certain about thee source? https://buyessayonlineforcheap.com/ essay phrases used in writing essay phrases used in writing https://buyessayonlineforcheap.com
I have been surfing online greater than three hours as of late, but I never discovered any fascinating article like yours. It's pretty worth sufficient for me. In my opinion, if all web owners and bloggers made good content material as you did, the net will be much more useful than ever before. https://onlineessayforyou.com/ writing an argumentative essay my essaymy essay https://onlineessayforyou.com/ https://onlineessayforyou.com/
I have been surfing online greater than three hours as of late, but I never discovered any fascinating article like yours. It's pretty worth sufficient for me. In my opinion, if all web owners and bloggers made good content material as you did, the net will be much more useful than ever before. https://onlineessayforyou.com/ writing an argumentative essay my essaymy essay https://onlineessayforyou.com/ https://onlineessayforyou.com/
Please let me know if you're looking for a article writer for your site. You have some really good posts and I feel I would be a good asset. If you ever want to take some of the load off, I'd really like to write some content for your blog in exchange for a link back to mine. Please send me an email if interested. Many thanks! https://buyessaysearch.com/ order an essay cheap order an essay cheap https://buyessaysearch.com/
Please let me know if you're looking for a article writer for your site. You have some really good posts and I feel I would be a good asset. If you ever want to take some of the load off, I'd really like to write some content for your blog in exchange for a link back to mine. Please send me an email if interested. Many thanks! https://buyessaysearch.com/ order an essay cheap order an essay cheap https://buyessaysearch.com/
Hi there everyone, it's my first pay a visit at this web page, and paragraph is truly fruitful designed for me, keep up posting these articles or reviews. https://allbestessaywritingservice.com write me an essay write me an essay https://allbestessaywritingservice.com
Hi there everyone, it's my first pay a visit at this web page, and paragraph is truly fruitful designed for me, keep up posting these articles or reviews. https://allbestessaywritingservice.com write me an essay write me an essay https://allbestessaywritingservice.com
I thiink this is among the most important info for me. And i'm glad reading your article. But want tto remark on few generaql things, The website style is great, the articles is really great : D. Good job, cheers https://essaywritingservicereddit.info cheap reliable essay writing service cheap reliable essay writing service https://essaywritingservicereddit.info
I think this is among the most important info for me. And i'mglad reading your article. But want to remark on few general things, The website style is great, the articles is really great : D. Good job, cheers https://essaywritingservicereddit.info cheap reliable essay writing service cheap reliable essay wroting service https://essaywritingservicereddit.info
I have read so many posts on the topic of the blogger lovers however this post is actually a fastidious piece of writing, keep it up. https://essaywritingusauk.com/ admission essay writing service buy essay uk services ukbuy essay uk services uk buy essay uk services uk buy essay uk services uk https://essaywritingusauk.com/ buy essay uk services uk https://essaywritingusauk.com/
I have read so many posts on the topic of the blogger lovers however this post is actually a fastidious piece of writing, keep it up. https://essaywritingusauk.com/ admission essay writing service buy essay uk services ukbuy essay uk services uk buy essay uk services uk buy essay uk services uk https://essaywritingusauk.com/ buy essay uk services uk https://essaywritingusauk.com/
What's up, I log on to your blog daily. Your humoristic style is awesome, keep up the good work! https://buyessayscc.com/ cheap custom essays cheap custom essays https://buyessayscc.com/
What's up, I log on to your blog daily. Your humoristic style is awesome, keep up the good work! https://buyessayscc.com/ cheap custom essays cheap custom essays https://buyessayscc.com/
Appreciating the hard work you put into your website and detailed information you provide. It's great to come across a blog every once in a while that isn't the same outdated rehashed information. Excellent read! I've saved your site and I'm including your RSS feeds to my Google account. get redirected here get redirected here (https://movpicture.com/) https://hanoiloan.com
Appreciating the hard work you put into your website and detailed information you provide. It's great to come across a blog every once in a while that isn't the same outdated rehashed information. Excellent read! I've saved your site and I'm including your RSS feeds to my Google account. get redirected here get redirected here (https://movpicture.com/) https://hanoiloan.com
I have reasd so many articles oor reviews about the blogger lovers but this paragraph is genuinely a fastidious post, keep it up. https://writinganessay.info essay writing services cheap essay writing services cheap https://writinganessay.info
I hzve read so many articles or reviews about the bloggeer lovers but this paragraph is genuinely a fastidious post, keep itt up. https://writinganessay.info essay writing services cheap essay writinng services cheap https://writinganessay.info
Howdy! I khow this is somewhat off topic but I was wondering which blog platform are you using for this site? I'm getting sick and tired of Wordpress because I've hhad issues with hackers and I'm looking at alternatives for another platform. I would bbe fantastic iff you could point me in tthe direction of a good platform. https://collegeapplicationessaywritingservice.info cheap essay writing service cheap essay writing service https://collegeapplicationessaywritingservice.info
Howdy! I know this is somewhhat off topic but I was wondering which blog platform are you using ffor this site? I'm getting sick and tired of Wordppress because I've had issues wirh hackers and I'm looking at alternatives for another platform. I would be fantastic if you could point me in the direction of a good platform. https://collegeapplicationessaywritingservice.info cheap essay writingg service cheap essay wrjting service https://collegeapplicationessaywritingservice.info
Hello there, You've done a fantastic job. I'll definitely digg it and personally suggest to my friends. I'm confident they will be benefited from this web site. https://essayserviceusukua.com paperwriter edumony paperwriter edumony https://essayserviceusukua.com
Hello there, You've done a fantastic job. I'll definitely digg it and personally suggest to my friends. I'm confident they wilol be benefited from thus web site. https://essayserviceusukua.com paperwriter edumony paperwriter edumony https://essayserviceusukua.com
I really love your site.. Very nice colors & theme. Did yyou make tjis site yourself? Please reply back ass I'm planning to create my very own blog and would love to find oout where you got this from or what the theme is called. Appreciate it! http://club-pet.com/__media__/js/netsoltrademark.php?d=forum.plastic-surgeon.com.ua%2Fforumdisplay.php%3Ff%3D11 Glenna
I really love your site.. Very nice colors & theme. Did you makke this site yourself? Please reply back as I'm planning to create my very owwn blog and would love to find out where you got this from or what the themee is called. Appreciate it! http://club-pet.com/__media__/js/netsoltrademark.php?d=forum.plastic-surgeon.com.ua%2Fforumdisplay.php%3Ff%3D11 Glenna
Hi are using Wordpress for your blog platform? I'm new to the blog world but I'm trying too get started and set up my own. Do you require any html coding knowledge to make your own blog? Any helpp would be greatly appreciated! https://blainelial7dy.medium.com/essay-en-espanol-6d492fcc63e2 edu birdie edu birdie https://esdrasd703maa8.medium.com/structure-of-a-personal-narrative-essay-381d02e7cd63
Hi aare using Wordpress for your blog platform? I'm neew to the blog world but I'm trying tto get started and set up my own.Do you require any html coding knowledge to make your own blog? Any help would be greatly appreciated! https://blainelial7dy.medium.com/essay-en-espanol-6d492fcc63e2 edu birdie edu birdie https://esdrasd703maa8.medium.com/structure-of-a-personal-narrative-essay-381d02e7cd63
Do you have a spam problem on this blog; I also aam a blogger, and I was wondering your situation; many of us have created some nice practices and we are looking to swap solutions with other folks, please shoot mee an eemail if interested. https://medium.com/@ewellh3zignv/mla-block-quote-5d9ac046b8da paper wiith writing paper with writing https://medium.com/@kallebgz48we8a/uc-admissions-essay-58d54f91416f
Do you have a spam problem on this blog; I also am a blogger, and I was wondering your situation; many of us have created some nice practices and we are looking to swap solutions with other folks, please shoot me an emaail if interested. https://medium.com/@ewellh3zignv/mla-block-quote-5d9ac046b8da paper ith writing paper wikth writing https://medium.com/@kallebgz48we8a/uc-admissions-essay-58d54f91416f
Hi there,I discovered your website by way of Google while looking for a similar subject, your site came up, it looks great. I've bookmarked iit in my google bookmarks. Hi there, ust was aware of your weblog thru Google, and located that it is really informative. I am gooing to be careful for brussels. I'll appreciate if you proceed this in future. Manny other folks shall be benefited out of your writing. Cheers! https://bestessaywritingservice.info scholarship essay writing service scholarship essay writing service https://writingmypaper.info
Hi there, I discovered your website by way of Google while looking for a similar subject, your site came up, it looks great. I've bookmarked it in my google bookmarks. Hi there, just was aware of your weblog thru Google, and located that iit is really informative. I am going to be careful for brussels. I'll appreciate if you proceed this in future. Many other folks shall be benefited out of your writing. Cheers! https://bestessaywritingservice.info scholarship essay writiung service scholarship ssay writing service https://writingmypaper.info