I have an OpenVPN server machine which resides on an isolated network, a NAT rule in the company's firewall is redirecting all traffic on port 1194 (tcp) from the public IP I chose to the internal address of the OpenVPN server machine. I'd like to create a Nagios check which will monitor the availability of the OpenVPN server. What would be the best method to monitor it, considering that the check will run from the world (a Nagios server) rather than from within the company?
2 Answers
I do it remotely, via NAGIOS
, using a local plugin called check_openvpn.pl
, invoked via nrpe
, which in turn uses OpenVPN's built-in management capability to report on its detailed status.
Since you're using TCP as the VPN bearer, you could do a simple TCP connectivity check on port 1194 (as Dennis notes in his answer) but the advantage of this plugin is it runs a fairly rigorous check of OpenVPN, and reports the CNs currently connected to the server. If it's reporting at that level, I can have confidence that the server is completely up and offering service to the world at large, which a simple connectivity check wouldn't give me.
The plugin came from this page at NAGIOS exchange; the author's website is apparently http://emergeworld.blogspot.com.
The gory details are: the following entry in the NAGIOS server's config (plus appropriate connecting logic):
define service{
use myconf-svc
host_name openvpn.server.hostname
service_description openvpn
check_command check_nrpe!check_openvpn
}
Then this in the OpenVPN server's nrpe.cfg
:
command[check_openvpn]=/usr/lib64/nagios/plugins/check_openvpn.pl -H localhost -p 11940 -P XXXXXXX
Then this at the end of the OpeVPN server's `.conf' file:
# enable the mgmt interface for monitoring - tom 20120814
management 127.0.0.1 11940 /etc/openvpn/man.pass
Note the 11940
common to the both the previous data; that's the port number for the management interface. The password in the nrpe.cfg
entry above (shown as XXXXXXX
) should also appear in the file /etc/openvpn/man.pass
.
-
What is that password? is that the password for a monitoring user which i need to create? Dec 15, 2013 at 11:18
-
It is a shared secret which appears (a) in the
nrpe.cfg
entry, and (b) in/etc/openvpn/man.pass
. It appears nowhere else, so you can pick what you like. Set file protections accordingly. Dec 15, 2013 at 11:32 -
When I run the
check_openvpn.pl
locally or from the monitoring server I get the proper results (OpenVPN OK: user1 user2), but Nagios shows this: (No output returned from plugin) , do you have an idea why could it happen? Dec 16, 2013 at 7:40 -
1There are a number of reasons why a plugin that runs locally will fail under NRPE; local firewall on the client, NRPE not set up right (it has a list of addresses it will talk to, in the config file), SSL vs. non-SSL issues, privilege issue (you run the local test as root, but NRPE runs without privilege), and so on. There are answers on SF already dealing with debugging that, so start with those, and post a new question if you don't find one that works for you. Dec 16, 2013 at 8:00
-
For OpenVPN, I simply monitor whether it is listening on the usual port:
define command {
command_name check_openvpn
command_line $USER1$/check_tcp -H $HOSTADDRESS$ -p 1194
}