I have two OpenVPN client setups, controlled by systemd services
openvpn.bar. They connect to different VPNs and may or may not be active at any point in time.
I'd like to set up different iptables firewall rules for them. The trouble is that the first OpenVPN process seems to grab the
tun0 interface, regardless of whether that turns out to be configuration foo or bar. The problem is I can't attach iptables rules to the interface because I don't know whether it goes with VPN foo or bar at the moment.
- is there a way to get OpenVPN to always issue the same interface names for a given configuration? I was looking for an option in the config file, but couldn't find one.
persist-tunseems insufficient as it does not seem to survive a reboot.
- is there a way to determine which interface goes with which configuration after the fact?
- given that the IP addresses I'm obtaining aren't entirely predictable either, I can't attach the rules to those either. Can anybody think of a trick where to attach them instead?