Continuously check status of OpenVPN connection

Question

I'm trying to check and display the status (connected/not connected) and the server's hostname/cn of an OpenVPN connection that should connect at every boot.

Now I've found out that in /var/log/syslog the connection is logged, which I could use to determine if Initialization Sequence Completed was logged and get the hostname/cn, 19 lines above from [brimstone] Peer Connection Initiated with [AF_INET]1.2.3.4:1234.

Taken this log, I may check for the Initialization Sequence Completed, which would mean that I am connected and the hostname, which I just want for a different script.

Now my problem is that I currently don't know if the connection is still alive and/or if I'm connected to another server. I could periodically check the log for changes but that seems a little extreme for a rather basic task.

How may I check the connection status of my OpenVPN and if connected get the Servers hostname/cn?

Answer 1

You do not need to do that, but you can still do it by means of checking your apparent external IP address: the following command

   wget 216.146.38.70:80

queries checkip.dyndns.org for your external IP. You should be able to recognize the current status of your connection that way.

Alternatively, you may check your routing table:

   $ ip route show
   0.0.0.0/1 via 10.8.0.17 dev tun0 
   default via 192.168.73.1 dev eth0  proto static 
   10.8.0.0/24 via 10.8.0.17 dev tun0 
   10.8.0.17 dev tun0  proto kernel  scope link  src 10.8.0.18 
   128.0.0.0/1 via 10.8.0.17 dev tun0 
   192.168.73.0/24 dev eth0  proto kernel  scope link  src 192.168.73.74  metric 1 
   IP.Address.Of.Your.OpenVPN.server via 192.168.73.1 dev eth0 

(this is for a routed OpenVPN, but this does not matter). The important line is the last one: if you have anything like this, your packets will be routed through the OpenVPN.

You can also use an instrument like mtr which pings and traceroutes simultaneously (and continuously!!) a given ip address, for instance:

   mtr www.debian.org

If the OpenVPN is up, you will see the packets routed through the tunnel (tun0 or tap0), not through your regular gateway.

As I said at the beginning, though, you do not need to do this: OpenVPN provides you with a mechanism to continuously check the status of the connection, and to restart it if need be:

--keepalive n m

A helper directive designed to simplify the expression of --ping and --ping-restart in server mode configurations. For example, --keepalive 10 60 expands as follows:

 if mode server:
   ping 10
   ping-restart 120
   push "ping 10"
   push "ping-restart 60"
 else
   ping 10
   ping-restart 60

You may use either keepalive or any suitable combination of ping, ping-restart, ping-exit, to control automatically the status of the connection.

Answer 2

You could perhaps use a combination of openvpn's:

up, down, uprestart and ping-restart

config file (or their corresponding command-line) directives?

Answer 3

As another user indicated, ip route show sample output of connected vpn: 0.0.0.0/1 via 192.121.241.129 dev tun0 default via 192.168.0.1 dev eth0 128.0.0.0/1 via 192.121.245.129 dev tun0 192.121.241.5 via 192.168.0.1 dev eth0

It reads incoming tunnel NAT (Network Address Translating) to local subnet which is 192.168 Outgoing tunnel via same NAT That's pretty strong indication of VPN as long as 192.121.241 cannot be traced back to your ISP. My vpn is in the same city, but when I look it up it says that its another ISP; the ISP behind my VPN for that VPN server.

Another way, just look up your IP address, and see which ISP it is associated with. If its yours your vpn is not connected. If its anything else likely your VPN is connected.