59

I'm developing a website for managing OpenVPN users with Django framework. But I need to know is there any way to extract active users from OpenVPN? My server is running Ubuntu 12.04.

84

There should be a status log you can look at to show you, mine is, for examle:

cat /etc/openvpn/openvpn-status.log

EDIT:

As an alternative, adding the flag --management IP port [pw-file] or adding that same directive to your server.conf, for example:

management localhost 7505

This would allow you to telnet to that port and offer you a list of commands to run:

telnet localhost 7505

help

  • 1
    Thanks but is there any other way not to watch for file changes? For example a library that lists connected users? – Hamid FzM Feb 2 '14 at 15:18
  • 1
    @HamidFzM not sure about a library, you can use the management interface I added as an edit; please don't use an IP other than localhost as it would surely be a detriment to your security – c4urself Feb 2 '14 at 17:05
  • @c4urself, my output for the .log is: bit.ly/1ORnsYp Where can I see the connected users? Is it possible to see the ips assigned to them via this .log? – Maxim V. Pavlov Jul 30 '15 at 19:21
  • @MaximV.Pavlov looks like no one is connected in your case. Yes, IP addresses are shown. – c4urself Aug 12 '15 at 8:09
  • 2
    /etc/openvpn/openvpn-status.log didn't work for me on Debian, it never changed, instead /var/run/openvpn/server.status did worked perfectly. – Nelson Oct 1 '17 at 8:20
20

To complete @sekrett answer :

killall -USR2 openvpn ; tail -f /var/log/syslog

It will keep running, it's not a "regular" kill, just a request to print some stats.

Displayed statistics are very readable. Sample output :

Oct 14 07:34:14 vpn2 openvpn[20959]: Updated,Fri Oct 14 07:34:14 2016
Oct 14 07:34:14 vpn2 openvpn[20959]: Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
Oct 14 07:26:26 vpn2 openvpn[20959]:
10.8.0.132,hostname1,213.219.XXX.XXX:63765,Fri Oct 14 07:25:01 2016
Oct 14 07:26:26 vpn2 openvpn[20959]:
10.8.0.242,hostname2,213.219.XXX.XXX:62416,Sun Sep 25 03:49:19 2016
  • Thanks for improvement. My answer was right but it lacks an example and explanation. :) – sekrett Dec 6 '17 at 16:45
7

I got the same need myself and the easiest solution I found out was to use as mentioned telnet to connect to the management interface(you'll have to add :management localhost 6666, in the server config file) .

To get the exact number of client you can do :

  • telnet localhost 6666
  • status

Then you'll get lot of logs :

10.9.10.11,test-docker,52.58.48.98:56859,Wed May  4 09:37:34 2016
10.9.7.45,test-docker,52.58.156.80:38774,Wed May  4 09:36:59 2016
10.9.1.103,test-docker,52.58.161.230:52201,Wed May  4 09:35:47 2016
GLOBAL STATS
Max bcast/mcast queue length,0
END
>CLIENT:ESTABLISHED,19845
>CLIENT:ENV,n_clients=19361
>CLIENT:ENV,time_unix=1462357164
  • look for => >CLIENT:ENV,n_clients=19361

In my case since I have a very large number of client, using the log file is definitely not very practical.

4

You can also send usr2 signal to openvpn process to make it write statistic information to syslog. This is safe, you don't need to reboot in case you did not enable management interface before.

  • can you write a command for this? – Shayan_Aryan Jun 28 '18 at 19:54
  • 1
    @MichaelC wrote it: killall -USR2 openvpn. Then watch the logs. It might be /var/log/syslog or /var/log/messages depending on distro. – sekrett Jun 29 '18 at 11:11
  • but it doesn't kill openvpn? – Shayan_Aryan Jul 13 '18 at 15:46
  • kill command can send different signals, USR2 will not kill, it is just a signal. You can see a list here: linux.org/threads/kill-signals-and-commands-revised.11625 or by running kill -l. – sekrett Jul 13 '18 at 16:39
  • I just tried it. It doesn't give the info about connected clients count – Shayan_Aryan Jul 16 '18 at 20:49
2

I manage our companys OpenVPN servers and the way I see active connections is like this,

add to /etc/openvpn/server.conf

management 127.0.0.1 5555

restart openvpn server

systemctl restart openvpn@server.service

add an OpenVPN Monitor Python package - this will run via a Gunicorn web server and show active connections,

mkdir /opt/openvpn-monitor

create a virtual env (not required but good practice with py packages)

cd /opt/openvpn-monitor
virtualenv venv
source venv/bin/activate

install required packages

pip install openvpn-monitor gunicorn

add a Monitor config file

vi /opt/openvpn-monitor/openvpn-monitor.conf

[openvpn-monitor]
site=your-openvpn-site
#logo=logo.jpg
#latitude=40.72
#longitude=-74
maps=True
geoip_data=/var/lib/GeoIP/GeoLite2-City.mmdb
datetime_format=%d/%m/%Y %H:%M:%S

[VPN1]
host=localhost
port=
name=Your VPN Server Name
show_disconnect=False

start the web server that will show active connections,

gunicorn openvpn-monitor -b 0.0.0.0:80 --name openvpn-monitor --daemon

To stop monitor

pkill gunicorn 

to see active connections, go to the public IP of your VPN server

http://<ip of openvpn server>

make sure to configure proper firewall for port 80, whitelist only trusted inbound IPs

enter image description here

1

Just use sacli with the following command. This will list the connected VPN clients.

/usr/local/openvpn_as/scripts/sacli VPNSummary
{
"n_clients": 15
}

To see all the IPs use this option. ./sacli VPNStatus

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.