OpenVPN TUN interface setup

[smcgrath12]

Hello, I am running Merlin 384.9 on RT-AC68. I have enabled both OpenVPN servers in TUN mode in the router. From what I see, the names of the interfaces are TUN21 and TUN22 every time (whenever I reboot the router or the OpenVPN process). I am not running any OpenVPN client on the router.

I have a requirement to add routes using these TUNs (Adding Multicast routes via SMCRoute). The commands need the correct name of the TUNs, it does not take "TUN+". Also, I cannot run these commands correctly unless both TUNs are UP and have IP addresses assigned to them when I run the commands. I tried using "services-start", but TUNs come up late in the boot process. A hard-coded delay works, but it is not ideal. Is there a "post-up" command (tied to an interface) available in the router that can run code when this "post-up" event is triggered for a new interface?

So, I would like to do:

1. How can my script get the TUN names (TUN21 and TUN22)? I look a peek at nvram and I could not find any reference to these named TUNs...

Or, how can you create a TUN adapter manually (using "ip tuntap" and "ip link set") in a persistent state? Then, can you force the OpenVPN server to use this "pre-existing" TUN and not create a brand new TUN? In this case, my script does not need to get the names of TUNs dynamically....

2. How can my script check the status of both TUNs, verifying that they are UP an IP assigned? I am assuming that I will need a while loop running continuously? Some sample code will be very helpful.

3. Should my script be tied to "services-start" or "openvpn-event"?

 

[RMerlin]

Interface names are hardcoded in the firmware code. TUN21 is server 1, TUN22 is server 2.

 

[Martineau]

2. How can my script check the status of both TUNs, verifying that they are UP an IP assigned?
Some sample code will be very helpful.

Although this script is designed for checking the status of VPN Clients (tun1+), perhaps it can be adapted for your VPN Server (tun2+) requirements...
i.e. the NVRAM variable naming scheme can easily be deduced, but you can list the associated NVRAM Server variables

nvram show 2>/dev/null | grep vpn_server[1-2]_ | sort

3. Should my script be tied to "services-start" or "openvpn-event"?

It depends...but usually the openvpn-event triggers such as vpn-server?-up are more appropriate.
NOTE: Once a VPN Server is UP, there is a cron watch-dog monitor created to automatically restart the VPN Server instance if it physically goes AWOL.

*/2 * * * * /etc/openvpn/server1/vpns-watchdog1.sh #CheckVPNServer1#
*/2 * * * * /etc/openvpn/server2/vpns-watchdog2.sh #CheckVPNServer2#