Proposed feature: restart services (like openvpn client) from the command prompt of opnsense

[pedrofln]

Today we cannot restart services (in my case, I needed to restart openvpn client) from the command prompt in opnsense. In PFsense there is the pfSsh.php that can be invoked to do that, but I have not found a similar one in OpnSense.

I think it would be a great feature do add to github.

[AdSchellevis]

some additional info from the forum, configd calls might look like:

configctl openvpn client list
configctl openvpn client start
configctl openvpn client stop
configctl openvpn client restart

[mschilt]

oh.. have been looking for that.. would be great to have it in the docs somewhere (CLI reference .. )

[fbrendel]

Another use case from the forum.

Is it possible to mix 'php' and 'configd' in openvpn.inc openvpn_services() and add the corresponding service actions?

[fichtner]

That's not intentional as we would rather want to flush out the PHP usage altogether.

There is a relatively new tool called "pluginctl" which can restart plugin configure calls, but in order for this to work the plugin must implement and advertise a respective plugin configure hook in its xxx_configure() function.

[fbrendel]

That's not intentional as we would rather want to flush out the PHP usage altogether.

Yes, that's what I thought.
Looks like we need a rewrite of the plugin. 😏

There is a relatively new tool called "pluginctl" which can restart plugin configure calls

But we need to restart VPN clients. Not reconfigure.

[fichtner]

same thing, the old code always reconfigures... so this is a feature request for openvpn? I did the low-level pluginification a while back so it's not so hard to push a command through pluginctl like:

# pluginctl openvpn client1 start/stop/restart

I guess that is what you want? :)

[fbrendel]

Exactly!
And a simple method to determine the client id, please 😎

[fichtner]

I thought there was a catch to this ;)

The ids are just numbers.... we don't even have to specify server or client. What kind of mapping do you want to do?

[fbrendel]

I need the client id for the Monit start/stop scripts.
E.g. client1 means clientVPNID.
But the UI doesn't show me the vpnid.
So I can't configure Monit without consulting config.xml or /var/etc/openvpn/

[fichtner]

It's a bit of a chicken-egg problem with the VPN ID. We can make it visible, but how do we link it to monit reliably? It needs a better tracking via UUID so we can list OpenVPNs in Monit, or at least some OpenVPN selector field type to make that magic happen.

[fbrendel]

Right, I think it's mandatory that os-monit offer references to services, openvpn clients and much more if it is to be integrated in the core system.
Thought a quick hack could solve the problem. 😞
For now let's use the solution described in the forum and wait for a new os-monit version and new openvpn MVC plugin. OK? 😀

[fichtner]

Sounds good. I'll take care of the pluginctl commands required here for now.

[fichtner]

It's possible to reload from the command line now:

# pluginctl openvpn_reload [interface (wan, lan, opt1, ...)]

Beyond this the utility is not strictly needed.

[tehrengruber]

It's possible to reload from the command line now:

# pluginctl openvpn_reload [interface (wan, lan, opt1, ...)]

Beyond this the utility is not strictly needed.

At least for me this did not work (version: OPNsense 19.7.10). What did however work was:

pluginctl -s openvpn restart

[marc-it]

Hi together,

pluginctl -s openvpn restart is working for me, too. But only for server1. Is there a option to restart server2 server3?

Best reguards marc,

[fichtner]

See cf1f4e0

[ssbarnea]

Could someone share the magic command for restarting the only vpn client configured from the command line? Apparently pluginctl openvpn does only sync config settings and nothing else, regardless what arguments you give it:

root@q:~ # pluginctl openvpn client1 restart
Syncing OpenVPN settings...done.

You can even miss to give the last two args and will to the same thing.

[fichtner]

https://forum.opnsense.org/index.php?topic=19240.msg88421#msg88421

[ssbarnea]

I am afraid this does not help me because my pfsense is only an openvpn client and not a server. It only has one client configured and no servers. Based on the forum link I suspect that that command works only for restarting servers, not clients.

[fichtner]

If you only have one client you should not have a problem prior to the patch. As said earlier "pluginctl -s openvpn restart" restarts the first OpenVPN instance it finds.