Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I check if my Debian OpenVPN client is connected? Is there a specific command I have to run? Or can I read it from the logfile?

Thanks.

Edit: The answers below provide great value in debugging. I used the same open vpn credentials on two different systems, causing issues.

share|improve this question
    
You want to check on the client that the client is connected to the VPN? Or you want to check on the server that client is connected to the VPN? –  Heis Spiter Mar 18 '13 at 16:28

4 Answers 4

up vote 4 down vote accepted

It isn't clear to me if you are asking from the perspective of a client or server. In any case one thing you should strongly look at is enabling the management interface on your OpenVPN daemon with this configuration option.

management 127.0.0.1 6001

With the management interface enabled you can connected to whatever port you setup for this purpose using netcat/telnet. Then you can issue the status command, or many other commands to determine exactly what is going on from the daemons perspective.

share|improve this answer
    
This is pretty nice. Thank you. –  Hendrik Mar 24 '13 at 20:39

There are a few methods, depending on what exactly you're trying to achieve. If you want to check if the client is running and you're using Debian's initscript, you can use the service command:

% sudo service openvpn status mammon; echo $?
 * VPN 'mammon' is running
0

If you want to check that the client thinks it is connected to the server, you can check the routing table for the VPN subnet or local interface existence:

% ip route | grep -q 10.8.0.1; echo $?
0
% ip link show dev tun0 > /dev/null; echo $?
0

If you want to check that the client is connected and the server is contactable, ping the server:

% ping -c1 -w5 -q 10.8.0.1 > /dev/null; echo $?
0
share|improve this answer

While I think @mgorven get a good answer, I'd like to propose another one which kind of puts the problem into a different perspective.

If one is using /etc/network/interfaces for configuring the network, it's possible to use it to control client OpenVPN tunnels. It goes like this:

  1. Use custom name of the tunnel device for the OpenVPN's dev option, for instance, have

    dev mytun
    

    in the OpenVPN configuration file.

    Let's say the config file is

    /etc/openvpn/client.conf
    
  2. Set up an entry for that device in the /etc/network/interfaces file, like this:

    iface mytun inet manual
        pre-up   /etc/init.d/openvpn start client
        pre-down /etc/init.d/openvpn stop  client
    

Having set things up this way, you can now do

# /sbin/ifup mytun
# /sbin/ifdown mytun

Now back to the original question — iface sections in the networking configuration file also support the post-up directives which could be used for scripting the "tunnel is ready" events.

Yet another approach, for a Desktop machine, might be using a visual tool like TunTun to manage OpenVPN tunnels.

share|improve this answer

In Ubuntu there is a file holding the current OpenVPN status at /var/run/openvpn.openvpn.status

It looks to be the same as output of status command of management interface but you don't need to enable it in OpenVPN.

You can do some processing of it in scripts, i.e. check if the counters increase over time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.