[TUTORIAL] OpenVPN Connection/Disconnection Email Notifications

Boy1979 · Nov 19, 2014

Hi,

i used some scripts to get an email if a client connect or disconnect from OpenVPN and so i would share my experience with you:

first of all you need 2 scripts which will be stored in /jffs/scripts:

connect script: /jffs/scripts/up.sh

Code:

#!/bin/sh
SMTP="<[B][COLOR="Red"]your SMTP address[/COLOR][/B]>"
FROM="<[B][COLOR="red"]email sender address[/COLOR][/B]>"
FROMNAME="<[B][COLOR="red"]from name[/COLOR][/B]>"
TO="<[B][COLOR="red"]recipient mail address[/COLOR][/B]>"

time=$(echo $(date +"%c"))

message=$(echo "<b>Connected Since:</b> $time<br><b>Real Address:</b> \
$untrusted_ip<br><b>Virtual Address:</b> \
$ifconfig_pool_remote_ip<br><b>Common \
Name:</b> $common_name<br><br>")

echo "Subject: OpenVPN CONNECT" >/tmp/mail.txt
echo "Content-Type: text/html" >>/tmp/mail.txt
echo "From: $FROMNAME<$FROM>" >>/tmp/mail.txt
echo "Date: `date -R`" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "Client has connected to <b>OpenVPN</b>:<br>" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "<br>$message" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "---<br>" >>/tmp/mail.txt
echo "Your friendly router." >>/tmp/mail.txt
echo "<br>" >>/tmp/mail.txt

/usr/sbin/sendmail -S"$SMTP" -f"$FROM" $TO < /tmp/mail.txt
rm /tmp/mail.txt

Fill in 'your SMTP address', 'email sender address', 'from name' and 'recipient mail address' with your own credentials.

disconnect script: /jffs/scripts/down.sh

Code:

#!/bin/sh
SMTP="<[B][COLOR="Red"]your SMTP address[/COLOR][/B]>"
FROM="<[B][COLOR="red"]email sender address[/COLOR][/B]>"
FROMNAME="<[B][COLOR="red"]from name[/COLOR][/B]>"
TO="<[B][COLOR="red"]recipient mail address[/COLOR][/B]>"

time=$(echo $(date +"%c"))

message=$(echo "<b>Connected Since:</b> $time<br><b>Real Address:</b> \
$untrusted_ip<br><b>Virtual Address:</b> \
$ifconfig_pool_remote_ip<br><b>Common \
Name:</b> $common_name<br><br>")

echo "Subject: OpenVPN DISCONNECT" >/tmp/mail.txt
echo "Content-Type: text/html" >>/tmp/mail.txt
echo "From: $FROMNAME<$FROM>" >>/tmp/mail.txt
echo "Date: `date -R`" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "Client has disconnected from <b>OpenVPN</b>:<br>" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "<br>$message" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "---<br>" >>/tmp/mail.txt
echo "Your friendly router." >>/tmp/mail.txt
echo "<br>" >>/tmp/mail.txt

/usr/sbin/sendmail -S"$SMTP" -f"$FROM" $TO < /tmp/mail.txt
rm /tmp/mail.txt

Fill in 'your SMTP address', 'email sender address', 'from name' and 'recipient mail address' with your own credentials.

Access your ROUTER via Browser and move to VPN --> VPN Details and add custom configuration:

Code:

script-security 2
--client-connect /jffs/scripts/up.sh
--client-disconnect /jffs/scripts/down.sh

and click apply.

Each time a client connects/disconnects, it will send an email notification to the recipient. You can play around with the message formatting in up.sh or down.sh if you want to customize the email.

The provided formatting will send a message looking like this:

connect:

Code:

Client has connected to [B]OpenVPN[/B]:

[B]Connected since:[/B] Wed Nov 19 19:53:20 2014
[B]Real Address:[/B] 192.168.1.102
[B]Virtual Address:[/B] 10.8.0.4
[B]Common Name:[/B] client5

---
Your friendly router.

disconnect:

Code:

Client has disconnected from [B]OpenVPN[/B]:

[B]Connected since:[/B] Wed Nov 19 19:53:20 2014
[B]Real Address:[/B] 192.168.1.102
[B]Virtual Address:[/B] 10.8.0.4
[B]Common Name:[/B] client5

---
Your friendly router.

Hope you find this useful. If anyone needs help they are welcome.

regards Boy1979

ttgapers · Nov 20, 2014

Boom

Nice work. Please see an updated version if you prefer using GMAIL and includes the authentication pieces.

Up

Code:

#!/bin/sh
# SMTP="<your SMTP address>"
# FROM="<email sender address>"
# FROMNAME="<from name>"
# TO="<recipient mail address>"

FROM="<your SMTP address>"
AUTH="<your gmail username>"
PASS="<your gmail password>"
FROMNAME="<your router name>"
TO="<recipient email address>"

time=$(echo $(date +"%c"))

message=$(echo "<b>Connected Since:</b> $time<br><b>Real Address:</b> \
$untrusted_ip<br><b>Virtual Address:</b> \
$ifconfig_pool_remote_ip<br><b>Common \
Name:</b> $common_name<br><br>")

echo "Subject: OpenVPN CONNECT" >/tmp/mail.txt
echo "Content-Type: text/html" >>/tmp/mail.txt
echo "From: $FROMNAME<$FROM>" >>/tmp/mail.txt
echo "Date: `date -R`" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "Client has connected to <b>OpenVPN</b>:<br>" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "<br>$message" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "---<br>" >>/tmp/mail.txt
echo "Your friendly router." >>/tmp/mail.txt
echo "<br>" >>/tmp/mail.txt

# /usr/sbin/sendmail -S"$SMTP" -f"$FROM" $TO < /tmp/mail.txt

cat /tmp/mail.txt | sendmail -H"exec openssl s_client -quiet \
-CAfile /jffs/configs/Equifax_Secure_Certificate_Authority.pem \
-connect smtp.gmail.com:587 -tls1 -starttls smtp" \
-f"$FROM" \
-au"$AUTH" -ap"$PASS" $TO 

rm /tmp/mail.txt

Down

Code:

#!/bin/sh
# SMTP="<your SMTP address>"
# FROM="<email sender address>"
# FROMNAME="<from name>"
# TO="<recipient mail address>"

FROM="<your SMTP address>"
AUTH="<your gmail username>"
PASS="<your gmail password>"
FROMNAME="<your router name>"
TO="<recipient email address>"

time=$(echo $(date +"%c"))

message=$(echo "<b>Connected Since:</b> $time<br><b>Real Address:</b> \
$untrusted_ip<br><b>Virtual Address:</b> \
$ifconfig_pool_remote_ip<br><b>Common \
Name:</b> $common_name<br><br>")

echo "Subject: OpenVPN DISCONNECT" >/tmp/mail.txt
echo "Content-Type: text/html" >>/tmp/mail.txt
echo "From: $FROMNAME<$FROM>" >>/tmp/mail.txt
echo "Date: `date -R`" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "Client has disconnected from <b>OpenVPN</b>:<br>" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "<br>$message" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "---<br>" >>/tmp/mail.txt
echo "Your friendly router." >>/tmp/mail.txt
echo "<br>" >>/tmp/mail.txt

# /usr/sbin/sendmail -S"$SMTP" -f"$FROM" $TO < /tmp/mail.txt

cat /tmp/mail.txt | sendmail -H"exec openssl s_client -quiet \
-CAfile /jffs/configs/Equifax_Secure_Certificate_Authority.pem \
-connect smtp.gmail.com:587 -tls1 -starttls smtp" \
-f"$FROM" \
-au"$AUTH" -ap"$PASS" $TO 

rm /tmp/mail.txt

Note, I also didn't need the .sh in the VPN details area. You will need to get the Equifax Secure Cert Authority cert and place it in the /jffs/configs folder prior to this working.

Cheers.

GorkyVVV · Aug 26, 2016

When using the following code:

Code:

#!/bin/sh
echo "Client connected!" | sendmail -H"exec openssl s_client -quiet -CAfile /jffs/configs/Equifax_Secure_Certificate_Authority.pem -connect smtp.gmail.com:587 -tls1 -starttls smtp" -f"FROM" -au"USER" -ap"PASS" TO

Saving it as up.sh with permissions 0777 in folder /jffs/scripts/

And putting the following in the custom configuration of OPENVPN on my RT-N66U running Asuswrt-Merlin 380.61:

Code:

script-security 2
--client-connect "/bin/sh /jffs/scripts/up.sh"

It gives me the following error in the system log when trying to connect an client:

Code:

WARNING: Failed running command (--client-connect): external program exited with error status: 2

The script executes just fine with PuTTY running the following command:

Code:

sh /jffs/scripts/up.sh

Any idea what the problem might be?

Thanks for the awesome script by the way!

john9527 · Aug 26, 2016

GorkyVVV said:
script-security 2
--client-connect "/bin/sh /jffs/scripts/up.sh"

In the custom config section, take out the /bin/sh (it only expects a script name)
and you don't need the quotes

Code:

script-security 2
--client-connect /jffs/scripts/up.sh

GorkyVVV · Aug 26, 2016

john9527 said:
In the custom config section, take out the /bin/sh (it only expects a script name)
and you don't need the quotes

Thanks for the reply! However when I do that the Export OpenVPN configuration file section of OpenVPN keeps displaying:

Code:

Initialinzing the settings of OpenVPN server now, please wait a few minutes to let the server to setup completed before VPN clients establish the connection.

The system logs also show:

Code:

Options error: --client-connect script fails with '/jffs/scripts/up.sh': No such file or directory
Options error: Please correct this error.

When I use the code mentioned above the OpenVPN server does boot and finds the file..

Any idea?

john9527 · Aug 26, 2016

GorkyVVV said:
Any idea?

try running the following command

dos2unix /jffs/scripts/up.sh

if that works, it means you saved the file in DOS/WIN format instead of Linux.

GorkyVVV · Aug 26, 2016

john9527 said:
it means you saved the file in DOS/WIN format instead of Linux.

Ha! That worked! Thank you soooo much!

Now I am on to tweaking the script. How would I use the following.

I am trying to display the data in Megabyte. However the Environmental Variables exports bytes_received.

I have tried a bit, this did not work: $(bytes_received / 1048576)

Any tips in the right direction, I am almost complete!

john9527 · Aug 26, 2016

GorkyVVV said:
I am trying to display the data in Megabyte. However the Environmental Variables exports bytes_received.

I have tried a bit, this did not work: $(bytes_received / 1048576)

assuming you are embedding that within an echo, try
$(expr $bytes_received / 1048576)

GorkyVVV · Aug 26, 2016

john9527 said:
assuming you are embedding that within an echo, try
$(expr $bytes_received / 1048576)

No joy, it returns 0.

This is the part of the script:

time=$(echo $(date +"%c"))

message=$(echo "Username: $username Time Down: \
$time Bytes Received: \
$(expr $bytes_received / 1048576) Bytes Sent: \
$bytes_sent Real Address: \
$untrusted_ip Virtual Address: \
$ifconfig_pool_remote_ip \
 ")

john9527 · Aug 26, 2016

GorkyVVV said:
No joy, it returns 0.

This is the part of the script:

time=$(echo $(date +"%c"))

message=$(echo "Username: $username Time Down: \
$time Bytes Received: \
$(expr $bytes_received / 1048576) Bytes Sent: \
$bytes_sent Real Address: \
$untrusted_ip Virtual Address: \
$ifconfig_pool_remote_ip \
 ")

all bash math is integer.....have you transferred at least a megabyte? In other words, it will round down to the integer megabyte value.

GorkyVVV · Aug 26, 2016

john9527 said:
all bash math is integer.....have you transferred at least a megabyte? In other words, it will round down to the integer megabyte value.

Sir! I am sorry, I did not transfer enough.

In the end this made it work as well: $((bytes_received / 1048576))

Thanks a bunch for all your help! Have a very good night!

john9527 · Aug 26, 2016

At least on the right track

if you want to do the floating point math in bash.... include this routine near the top of your script.

Code:

calc ()
# Routine for fp math in scripts
{
    local in="$(echo "$@" | sed -e 's/\[/(/g' -e 's/\]/)/g')";
        awk 'BEGIN {print '"$in"'}' < /dev/null
        }

then use this expression for the megabytes

Code:

$(calc $bytes_received/1048576)

Goobi · Aug 26, 2016

Any suggestions on how to modify this script to send a email when one of the five openvpn clients on the router does down?

amplatfus · Feb 22, 2018

Hi,
After adding below lines to vpn config, VPN doesn't connect any more. Could you please help? Thank you for this thread and for help!

Code:

script-security 2
--client-connect /jffs/scripts/up.sh
--client-disconnect /jffs/scripts/down.sh

amplatfus · Feb 22, 2018

Hi again,

In my case I solve it only buy this version filled in custom VPN configuration:

Code:

script-security 2
up /jffs/scripts/up.sh
down /jffs/scripts/down.sh

All the best,
amplatfus

amplatfus · Feb 24, 2018

Please, I am looking for a list of variables available in order to customize these notifications. Appreciate any reply. Thank you!

bennor · Dec 12, 2019

Bumping this older thread. Ran into a number of issues attempting to use the code provided by the OP with OpenVPN server on an Asus-Merlin RT-AC68U router running firmware 384.13_0. Primarily among them trying to use an email provider who uses SMTP security and authentication.

Couple of other comments. Both the up.sh and down.sh scripts need to have permissions changed to 0755 after creating them. Note I used WinSCP to create the two sh files and to change the permissions to 0755. I also only used one "TO" email address, I assume more can be used by separating them with a coma or semi-colon (but not sure).

*** NOTE: PROCEED AT YOUR OWN RISK!!! ***

File on Asus router: /jffs/scripts/up.sh

Code:

#!/bin/sh

SMTP="<Outbound SMTP server address with security port>"
# Example SMTP: "smtp.xyz.com:465" or "smtp.xyz:587"
FROM="<The email address used for authorization and sending email>"
PWD="<Email Password Authentication>"
FROMNAME="<Put a from name here>"
TO="<Put the to email address name here>"

time=$(echo $(date +"%c"))

message=$(echo "<b>Connected Since:</b> $time<br><b>Real Address:</b> \
$untrusted_ip<br><b>Virtual Address:</b> \
$ifconfig_pool_remote_ip<br><b>Common \
Name:</b> $common_name<br><br>")

echo "Subject: OpenVPN CONNECT" >/tmp/mail.txt
echo "Content-Type: text/html" >>/tmp/mail.txt
echo "From: $FROMNAME<$FROM>" >>/tmp/mail.txt
echo "Date: `date -R`" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "Client has connected to <b>OpenVPN</b>:<br>" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "<br>$message" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "---<br>" >>/tmp/mail.txt
echo "Your friendly router." >>/tmp/mail.txt
echo "<br>" >>/tmp/mail.txt

# /usr/sbin/sendmail -S"$SMTP" -f"$FROM" $TO < /tmp/mail.txt
/usr/sbin/sendmail -f"$FROM" $TO -H"exec openssl s_client -quiet -tls1 -starttls smtp -connect $SMTP" < /tmp/mail.txt -au"$FROM" -ap"$PWD"

rm /tmp/mail.txt

File on Asus router: /jffs/scripts/down.sh

Code:

#!/bin/sh

SMTP="<Outbound SMTP server address with security port>"
# Example SMTP: "smtp.xyz.com:465" or "smtp.xyz:587"
FROM="<The email address used for authorization and sending email>"
PWD="<Email Password Authentication>"
FROMNAME="<Put a from name here>"
TO="<Put the to email address name here>"

time=$(echo $(date +"%c"))

message=$(echo "<b>Connected Since:</b> $time<br><b>Real Address:</b> \
$untrusted_ip<br><b>Virtual Address:</b> \
$ifconfig_pool_remote_ip<br><b>Common \
Name:</b> $common_name<br><br>")

echo "Subject: OpenVPN DISCONNECT" >/tmp/mail.txt
echo "Content-Type: text/html" >>/tmp/mail.txt
echo "From: $FROMNAME<$FROM>" >>/tmp/mail.txt
echo "Date: `date -R`" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "Client has disconnected from <b>OpenVPN</b>:<br>" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "<br>$message" >>/tmp/mail.txt
echo "" >>/tmp/mail.txt
echo "---<br>" >>/tmp/mail.txt
echo "Your friendly router." >>/tmp/mail.txt
echo "<br>" >>/tmp/mail.txt

# /usr/sbin/sendmail -S"$SMTP" -f"$FROM" $TO < /tmp/mail.txt
/usr/sbin/sendmail -f"$FROM" $TO -H"exec openssl s_client -quiet -tls1 -starttls smtp -connect $SMTP" < /tmp/mail.txt -au"$FROM" -ap"$PWD"

rm /tmp/mail.txt

Next add the following code to the Asus-Merlin administration page VPN > VPN Server - OpenVPN > VPN Details: Advanced Settings > Custom Configuration, and select the Apply button:

Code:

script-security 2
--client-connect /jffs/scripts/up.sh
--client-disconnect /jffs/scripts/down.sh

With those changes one should be able to use any email SMTP server that requires the use of security and authentication to send email. Currently working on Yahoo/ATT email when an OpenVPN client logs in and logs out of the Asus router OpenVPN server.. Haven't tried it on other email services. Note if using Gmail one may have to enable "Less Secure Apps" to get email to send properly on the gmail system.

Note: Some information used in the above scripts was pulled from this thread: https://www.snbforums.com/threads/notifications-e-mail.8190/

elorimer · Dec 13, 2019

One small note. If one has configured Diversion to send email, then I think it is tons easier to use its email.conf file for the credentials and a separate email script that accepts the text you want to send as a parameter; use that for any notification you want to send. pixelserv - A Better One-pixel Webserver for Adblock

lbradio · Mar 5, 2020

One small downsize on adding the Custom Configuration is that OpenVPN connections does not show up anymore in the System Log. At least not in debug mode.

JoGi · Mar 7, 2020

Does somebody have any idea or solution.

my output give at Common Name: "client" and not the user name thats has logged in/out :-(

Thread starter	Title	Forum	Replies	Date
S	No internet for router clients (OpenVPN + stunnel)	Asuswrt-Merlin	1	Sunday at 1:44 PM
	ASUS Merlin on RT-AC86U OpenVPN Server not blocking IP when a client connects	Asuswrt-Merlin	2	Jan 8, 2025
	OpenVPN Setting Merlin AXE-16000	Asuswrt-Merlin	1	Jan 6, 2025
F	OpenVPN Server - Client speeds seem capped at 20mbps??	Asuswrt-Merlin	3	Jan 4, 2025
	OpenVPN Client Connection through existing OpenVPN Router Connection causes DISCONNECT	Asuswrt-Merlin	29	Dec 21, 2024
M	2 separate clients on OpenVPN server	Asuswrt-Merlin	4	Dec 20, 2024
D	Solved Openvpn client dns	Asuswrt-Merlin	2	Nov 19, 2024
D	WireGuard removing OpenVPN on ASUS Routers ?	Asuswrt-Merlin	2	Nov 14, 2024
T	[Help] Problems setting up OpenVPN	Asuswrt-Merlin	7	Oct 16, 2024
N	dedicated router for OpenVPN	Asuswrt-Merlin	4	Oct 16, 2024

[TUTORIAL] OpenVPN Connection/Disconnection Email Notifications

New Around Here

Senior Member

New Around Here

Part of the Furniture

New Around Here

Part of the Furniture

New Around Here

Part of the Furniture

New Around Here

Part of the Furniture

New Around Here

Part of the Furniture

Regular Contributor

Senior Member

Senior Member

Senior Member

Part of the Furniture

Part of the Furniture

Regular Contributor

Regular Contributor

Attachments

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest