1

We're running a multi-site business, each site connected to a central OpenVPN server to provide access to internal systems. I'm currently using Monit to check if OpenVPN client is running and if the remote server is working, but since a few of the sites are running on unstable 4G modems, the VPN connection sometimes breaks without the process dying, which makes monit think everything's fine. A simple ping against the VPN gateway will show if the connection is working or not, but when I read the monit documentation the ping check doesn't seem to be mixable with process-checks, so I can add the check but can't actually restart the process with it.

Is there some obvious way to do this that I'm missing, or is there another way to make OpenVPN capable of recovering from this kind of problem on its own?

This is my monit-check (basically cut-n-paste from the manual):

check process openvpn with pidfile /var/run/openvpn.client.pid
    start program = "/etc/init.d/openvpn start"
    stop  program = "/etc/init.d/openvpn stop"
    if failed host *my-vpn-gateway* port 1194 type udp then restart
    group net
    depends openvpn_init
    depends openvpn_bin

check file openvpn_init with path /etc/init.d/openvpn
    group net

check file openvpn_bin with path /usr/sbin/openvpn
    group net
1
1

it seems that the workaround is to have 2 checks: 1 for the processs and 1 to ensure the gateway host is reachable

check process vpn-network with pidfile /var/run/vpn-network.pid
   start program = "/etc/init.d/openvpn start vpn-network.com"
   stop program = "/etc/init.d/openvpn stop vpn-network.com"
 
check host tap0 with address 1.1.1.1
    start program = "/etc/init.d/openvpn start vpn-network.com"
    stop program = "/etc/init.d/openvpn stop vpn-network.com"
    if failed
        icmp type echo count 5 with timeout 15 seconds
    then restart

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.