5

I have an OpenVPN server machine which resides on an isolated network, a NAT rule in the company's firewall is redirecting all traffic on port 1194 (tcp) from the public IP I chose to the internal address of the OpenVPN server machine. I'd like to create a Nagios check which will monitor the availability of the OpenVPN server. What would be the best method to monitor it, considering that the check will run from the world (a Nagios server) rather than from within the company?

1
  • Define what it is you want to verify. Then what to monitor should be obvious. Dec 15, 2013 at 10:32

2 Answers 2

7

I do it remotely, via NAGIOS, using a local plugin called check_openvpn.pl, invoked via nrpe, which in turn uses OpenVPN's built-in management capability to report on its detailed status.

Since you're using TCP as the VPN bearer, you could do a simple TCP connectivity check on port 1194 (as Dennis notes in his answer) but the advantage of this plugin is it runs a fairly rigorous check of OpenVPN, and reports the CNs currently connected to the server. If it's reporting at that level, I can have confidence that the server is completely up and offering service to the world at large, which a simple connectivity check wouldn't give me.

The plugin came from this page at NAGIOS exchange; the author's website is apparently http://emergeworld.blogspot.com.

The gory details are: the following entry in the NAGIOS server's config (plus appropriate connecting logic):

define service{
    use                 myconf-svc
    host_name           openvpn.server.hostname
    service_description openvpn
    check_command       check_nrpe!check_openvpn
    }

Then this in the OpenVPN server's nrpe.cfg:

command[check_openvpn]=/usr/lib64/nagios/plugins/check_openvpn.pl -H localhost -p 11940 -P XXXXXXX

Then this at the end of the OpeVPN server's `.conf' file:

# enable the mgmt interface for monitoring - tom 20120814
management 127.0.0.1 11940 /etc/openvpn/man.pass

Note the 11940 common to the both the previous data; that's the port number for the management interface. The password in the nrpe.cfg entry above (shown as XXXXXXX) should also appear in the file /etc/openvpn/man.pass.

6
  • What is that password? is that the password for a monitoring user which i need to create?
    – Itai Ganot
    Dec 15, 2013 at 11:18
  • It is a shared secret which appears (a) in the nrpe.cfg entry, and (b) in /etc/openvpn/man.pass. It appears nowhere else, so you can pick what you like. Set file protections accordingly.
    – MadHatter
    Dec 15, 2013 at 11:32
  • When I run the check_openvpn.pl locally or from the monitoring server I get the proper results (OpenVPN OK: user1 user2), but Nagios shows this: (No output returned from plugin) , do you have an idea why could it happen?
    – Itai Ganot
    Dec 16, 2013 at 7:40
  • 1
    There are a number of reasons why a plugin that runs locally will fail under NRPE; local firewall on the client, NRPE not set up right (it has a list of addresses it will talk to, in the config file), SSL vs. non-SSL issues, privilege issue (you run the local test as root, but NRPE runs without privilege), and so on. There are answers on SF already dealing with debugging that, so start with those, and post a new question if you don't find one that works for you.
    – MadHatter
    Dec 16, 2013 at 8:00
  • Thanks a lot @MadHatter , everything works now perfectly.
    – Itai Ganot
    Dec 16, 2013 at 14:39
3

For OpenVPN, I simply monitor whether it is listening on the usual port:

define command {
        command_name    check_openvpn
        command_line    $USER1$/check_tcp -H $HOSTADDRESS$ -p 1194
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .