Thank you as always for your good reporting!
Thank you for reporting.
I always had a few lines in /mnt/sda1/autorun/scripts/post-mount.sh that would copy the certificate, the .ovpn and the .auth file directly into /etc/openvpn/config/client/, if they didn't exist there.
check_password_file () {
logit "check_password_file $*. Get password file for: ${OVPN_CLIENT_CONF}"
\rm -f "$CLIENTDIR"/idpw
# Find specified user/password authentification file:
PASSWORDFILE=$(grep "^auth-user-pass" "${OVPN_CLIENT_CONF}" | awk '{ print $2 }')
f="$(basename "${OVPN_CLIENT_CONF}" 2>/dev/null)"; # se1-2.azirevpn.net.ovpn
logit "Information: Password file according to $f:${PASSWORDFILE}"
if [ -s "${OPENVPN_CONF_DIR}/${PASSWORDFILE}" ]; then2021-07-28 23:15:14; 5481.23; [OpenVPN]; [rc.common 5181 check_password_file . Get password file for: /etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.ovpn];
2021-07-28 23:15:14; 5481.25; [OpenVPN]; [rc.common 5181 Information: Password file according to ipvanish-NL-Amsterdam-ams-a42.ovpn::];
2021-07-28 23:15:14; 5481.26; [OpenVPN]; [rc.common 5181 ipvanish-NL-Amsterdam-ams-a42.ovpn: Password file not given. Try to find/create one...];
2021-07-28 23:15:14; 5481.27; [OpenVPN]; [rc.common 5181 Information: find_password_file ];
2021-07-28 23:15:14; 5481.28; [OpenVPN]; [rc.common 5181 Processing /etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.ovpn ...];
2021-07-28 23:15:14; 5481.30; [OpenVPN]; [rc.common 5181 Processing /etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.auth ...];
2021-07-28 23:15:14; 5481.31; [OpenVPN]; [rc.common 5181 Found possible password file: /etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.auth];
2021-07-28 23:15:14; 5481.32; [OpenVPN]; [rc.common 5181 Information: fix_password_file /etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.auth];
2021-07-28 23:15:14; 5481.34; [OpenVPN]; [rc.common 5181 Possible password file: /etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.auth];2021-07-28 23:23:21; 5968.21; [OpenVPN]; [rc.common 28431 check_password_file . Get password file for: /etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.ovpn];
2021-07-28 23:23:21; 5968.23; [OpenVPN]; [rc.common 28431 Information: Password file according to ipvanish-NL-Amsterdam-ams-a42.ovpn:/etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.auth:];
2021-07-28 23:23:21; 5968.24; [OpenVPN]; [rc.common 28431 ipvanish-NL-Amsterdam-ams-a42.ovpn: Password file given but does not exist:/etc/openvpn/config/client/ipvanish-NL-Amsterdam-ams-a42.auth. Try to find another one...];
2021-07-28 23:23:21; 5968.26; [OpenVPN]; [rc.common 28431 Information: find_password_file ];root@R7800:/$ ip route show table novpn
Error: argument "novpn" is wrong: table id value is invalid
root@R7800:/$ ip rule show
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
root@R7800:/$ /usr/bin/addon_bypassvpnip.sh force
grep: /etc/iproute2/rt_tables: No such file or directory
Error: argument "novpn" is wrong: table id value is invalid
Error: argument "novpn" is wrong: invalid table ID
Error: argument "novpn" is wrong: invalid table ID
Error: argument "novpn" is wrong: invalid table ID
Error: argument "novpn" is wrong: "table" value is invalid
Error: argument "novpn" is wrong: table id value is invalid
Error: argument "novpn" is wrong: "table" value is invalid
Error: argument "novpn" is wrong: invalid table ID
Starting Firewall...
Done! [ "$(grep -c "^\<${TID}\>.*\<${NOVPN_TABLE}\>$" /etc/iproute2/rt_tables)" = "0" ] && echo "$TID $NOVPN_TABLE" >> /etc/iproute2/rt_tables [ "$(grep -c "${NOVPN_TABLE}$" /etc/iproute2/rt_tables)" -eq "0" ] && [ "$(grep -c "^$TID" /etc/iproute2/rt_tables)" -eq "0" ] && echo "$TID $NOVPN_TABLE" >> /etc/iproute2/rt_tables
3. All your *.ovpn and correspondingly password files *.auth should be stored at USBs directory /openvpn-client
(These files are at boot (even in Voxel original) copied by hotplug2 to /etc/openvpn/config/client/)
The add-on will only read/backup files to/from this directory.
THANK YOU!
No, the certs are not copied...
hmm, indeed the killswitch I did't test.
if kamoj_reverse_bypass_vpn=1 then generate /tmp/openvpn/firewall-start-openvpnkillswitch.sh with this contents:
for each $ip_to_vpn in kamoj_ips_to_vpn do:
iptables -w -I FORWARD -i br0 -s $ip_to_vpn -o ${WAN_IF} -m state --state NEW -j REJECT"
next
for each $mac_to_vpn in kamoj_macs_to_vpn do:
iptables -w -I FORWARD -i br0 -m mac --mac-source $mac_to_vpn -o ${WAN_IF} -m state --state NEW -j REJECT"
next
# and the above code would need to be written if kill-switch is enabled; the option "no killswitch for bypassed devices" I would simply ignore with reverse bypass.
else
existing code to generate /tmp/openvpn/firewall-start-openvpnkillswitch.sh
fiFor the ebtables, you’d need to do something with the markAnd for the bypass "WiFi Interface" (involning ebtables)? ...
Relax and have a great holiday!!!
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
