Check openVPN client connected Debian

Question

How can I check if my Debian OpenVPN client is connected? Is there a specific command I have to run? Or can I read it from the logfile?

Thanks.

Edit: The answers below provide great value in debugging. I used the same open vpn credentials on two different systems, causing issues.

Answer 1

It isn't clear to me if you are asking from the perspective of a client or server. In any case one thing you should strongly look at is enabling the management interface on your OpenVPN daemon with this configuration option.

management 127.0.0.1 6001

With the management interface enabled you can connected to whatever port you setup for this purpose using netcat/telnet. Then you can issue the status command, or many other commands to determine exactly what is going on from the daemons perspective.

Answer 2

There are a few methods, depending on what exactly you're trying to achieve. If you want to check if the client is running and you're using Debian's initscript, you can use the service command:

% sudo service openvpn status mammon; echo $?
 * VPN 'mammon' is running
0

If you want to check that the client thinks it is connected to the server, you can check the routing table for the VPN subnet or local interface existence:

% ip route | grep -q 10.8.0.1; echo $?
0
% ip link show dev tun0 > /dev/null; echo $?
0

If you want to check that the client is connected and the server is contactable, ping the server:

% ping -c1 -w5 -q 10.8.0.1 > /dev/null; echo $?
0

Answer 3

While I think @mgorven get a good answer, I'd like to propose another one which kind of puts the problem into a different perspective.

If one is using /etc/network/interfaces for configuring the network, it's possible to use it to control client OpenVPN tunnels. It goes like this:

1. Use custom name of the tunnel device for the OpenVPN's dev option, for instance, have

   dev mytun
   

   in the OpenVPN configuration file.

   Let's say the config file is

   /etc/openvpn/client.conf
   

2. Set up an entry for that device in the /etc/network/interfaces file, like this:

   iface mytun inet manual
       pre-up   /etc/init.d/openvpn start client
       pre-down /etc/init.d/openvpn stop  client
   

Having set things up this way, you can now do

# /sbin/ifup mytun
# /sbin/ifdown mytun

Now back to the original question — iface sections in the networking configuration file also support the post-up directives which could be used for scripting the "tunnel is ready" events.

Yet another approach, for a Desktop machine, might be using a visual tool like TunTun to manage OpenVPN tunnels.

Answer 4

In Ubuntu there is a file holding the current OpenVPN status at /var/run/openvpn.openvpn.status

It looks to be the same as output of status command of management interface but you don't need to enable it in OpenVPN.

You can do some processing of it in scripts, i.e. check if the counters increase over time.

Answer 5

ping -c  1 whoami.ultradns.net

EDIT: curl https://ipapi.co/json

Returns your IP address (of your client). So very easy to see if your VPN is connected / what VPN server you are connected via e.g a Foreign country.

No config required.