Rotating client across VPN client connections:nvram error

[Goobi]

Hello Community,

I am running Merlin 380.58 on a 68U. I am using PIA VPN on the router with policy based routing and got that setup to use client1,3,5 all pointing to different PIA servers. My goal is to create a few scripts that will allow me to rotate a given VPN client among the three PIA servers on a weekly basis using a few crude scripts and cron.

Here are my planned scripts:

vpn1tovpn3.sh:
#!/bin/sh
nvram unset vpn_client1_clientlist
nvram set vpn_client3_clientlist=<FranklinsiPhone>10.0.10.22>0.0.0.0>VPN
nvram commit

vpn3tovpn5.sh:
#!/bin/sh
nvram unset vpn_client3_clientlist
nvram set vpn_client5_clientlist=<FranklinsiPhone>10.0.10.22>0.0.0.0>VPN
nvram commit

vpn5tovpn1.sh:
#!/bin/sh
nvram unset vpn_client5_clientlist
nvram set vpn_client1_clientlist=<FranklinsiPhone>10.0.10.22>0.0.0.0>VPN
nvram commit

However, my testing of the nvram set command in the script does not appear to be working. I get the following error:

#nvram set vpn_client5_clientlist=<iPhone>10.0.10.22>0.0.0.0>VPN
-sh: can't open iPhone: no such file

If I assign the client source IP from the GUI and then run the nvram get command, I can see the following:

vpn_client5_clientlist=<iPhone>10.0.100.22>0.0.0.0>VPN

It appears I am providing the parameters correctly in the nvram set so not sure what could be causing this error. From the GUI, it appears that the field in question is the description field which would get populated when you select the source IP or you can type in whatever you want there.

If I run the nvram command using a different name like 'test' I get the same error. If I run the command like this (leaving description blank), it does not error out but I don't get the results I expected:

nvram set vpn_client5_clientlist=<>10.0.10.22>0.0.0.0>VPN
or
nvram set vpn_client5_clientlist=<10.0.10.22>0.0.0.0>VPN

It does not fail but seems to set the value as a blank:

#nvram get vpn_client5_clientlist

#

Any ideas what I may be doing wrong or if this is even possible? Thanks in advance.

 

[john9527]

It interprets the < and > as redirects. Put the string value you are setting in quotes.

 

[Goobi]

It interprets the < and > as redirects. Put the string value you are setting in quotes.

Thanks, that worked. I have noticed that when I execute the nvram set command it shows the source client assigned to the new VPN, but the source client is never routed to the new client vpn. So for example, I run the following commands:

service stop_vpnclient3
nvram unset vpn_client3_clientlist
nvram set vpn_client5_clientlist="<iPhone>10.0.200.120>0.0.0.0>VPN"
nvram commit
service start_vpnclient5

I if I go to the GUI I can see the VPN client 5 started and can see the above source description, ip address, desteination ip, inferface, all listed correctly under the "Rules for routing client traffic through the tunnel (Max Limit : 100)" section. Unfortunately, the client is still pointing to my ISP IP address instead of the VPNs.

If I go through the GUI and add the client that way, it works as expected. Am I perhaps missing a step in my command line attempts when compared to when is being executed on the GUI?

Thanks in advance.

 

[john9527]

If I go through the GUI and add the client that way, it works as expected. Am I perhaps missing a step in my command line attempts when compared to when is being executed on the GUI?

You need to restart any clients that have changed following the nvram changes....

service restart_vpnclientx

where x is the client number

EDIT: Oh....and just to avoid any potential problems, make sure the order you restart them is such that the same client isn't active on two vpn instances at the same time.

EIDT2: One more thing....I'd put at least a 60sec delay in between the restarts.

 

[Goobi]

I noted I typo'ed the source IP address when I was execurting via the command line. After making that fix, all works as expected. Now, I just need to figure out the cron timing of my scripts execute weekly. Thanks for your help @john9527.