[SOLVED] Why does the openvpn vpnclient2-route-up script fail?

[waeking]

LOOK at this post for corrected scripts https://www.snbforums.com/threads/s...ient2-route-up-script-fail.49634/#post-441378

#!/bin/sh
#
# Enable port forwarding when using Private Internet Access
#
TRANSUSER=USER
TRANSPASS=PASSWORD
TRANSHOST=IP1
TRANSGUI=IP2
TRANSPORT=IP1PORT

#port_forward_assignment
  CLIENT_ID=`head -n 100 /dev/urandom | sha256sum | tr -d " -"`
echo $CLIENT_ID > /tmp/mnt/Merlin/openvpn.d/client.id
  JSON=`curl --interface $dev "http://209.222.18.222:2000/?client_id=$CLIENT_ID" 2>/dev/null`
echo $JSON > /tmp/mnt/Merlin/openvpn.d/json
# delete old port from file and add new port
PORT=$(echo $JSON | awk 'BEGIN{r=1;FS="[{}\":]+"} /port/{r=0; print $3} END{exit r}')
echo $PORT > /tmp/mnt/Merlin/openvpn.d/port.forward
#echo "Creating New Forwarding rules for port:"$PORT" on device "$dev" and forwading to "$TRANSHOST
        iptables -I FORWARD -i $dev -p udp -d $TRANSHOST --dport $PORT -j ACCEPT
        iptables -I FORWARD -i $dev -p tcp -d $TRANSHOST --dport $PORT -j ACCEPT
        iptables -t nat -I PREROUTING -i $dev -p udp --dport $PORT -j DNAT --to-destination $TRANSHOST
        iptables -t nat -I PREROUTING -i $dev -p tcp --dport $PORT -j DNAT --to-destination $TRANSHOST
#transmission_change_port
transmission-remote $TRANSGUI:$TRANSPORT --auth $TRANSUSER:$TRANSPASS --port $PORT

This is for PIA
ClIENT_ID shows up in file. However the JSON does not show up in file. This script just creates an empty file. I am just using echo to debug where things are going wrong and those lines will be deleted once this is running properly.

 

[waeking]

I think that it may have to do with the vpn not completely setup when this is run. Is there a way to test with a positive ping though the tunnel before the curl command is executed? Or to rerun the curl command until a port is given? perhaps with a sleep 5 seconds between tries and a max of say 10 tries.

 

[john9527]

You can't include any commands that access the internet from the scripts called by openvpn-event. The tunnel is not actually up until all the script phases exit (I ran into this when trying to use STUN to get the VPN address from within the openvpn phase scripts).

What you need to do is start another script from within route-up, which waits for the tunnel to be available.

 

[waeking]

Thanks I have created this script called vpnclient2-port-forward

#!/bin/sh
# vpnclient2-port-forward
#
# Enable port forwarding when using Private Internet Access
#
TRANSUSER=USER
TRANSPASS=PASSWORD
TRANSHOST=IP1
TRANSGUI=IP2
TRANSPORT=IP1PORT
dev=$1

#wait for tunnel to be up
timeout=2 # Wait for two seconds for a reply.
ip=209.222.18.222 # Use IP address assigned to tunnel endpoint.
while ! ping -I $dev -W "$timeout" -c 1 "$ip" &>/dev/null; do
  sleep 1
done

#port_forward_assignment
  CLIENT_ID=`head -n 100 /dev/urandom | sha256sum | tr -d " -"`
  JSON=`curl --interface $dev "http://209.222.18.222:2000/?client_id=$CLIENT_ID" 2>/dev/null`
echo $JSON > /tmp/mnt/Merlin/openvpn.d/json
# delete old port from file and add new port
PORT=$(echo $JSON | awk 'BEGIN{r=1;FS="[{}\":]+"} /port/{r=0; print $3} END{exit r}')
echo $PORT > /tmp/mnt/Merlin/openvpn.d/port.forward
#echo "Creating New Forwarding rules for port:"$PORT" on device "$dev" and forwading to "$TRANSHOST
       iptables -I FORWARD -i $dev -p udp -d $TRANSHOST --dport $PORT -j ACCEPT
       iptables -I FORWARD -i $dev -p tcp -d $TRANSHOST --dport $PORT -j ACCEPT
       iptables -t nat -I PREROUTING -i $dev -p udp --dport $PORT -j DNAT --to-destination $TRANSHOST
       iptables -t nat -I PREROUTING -i $dev -p tcp --dport $PORT -j DNAT --to-destination $TRANSHOST
#transmission_change_port
transmission-remote $TRANSGUI:$TRANSPORT --auth $TRANSUSER:$TRANSPASS --port $PORT

When

service restart_vpnclient2
./vpnclient2-port-forward tun12

all works well and the script waits

In vpnclient2-route-up is not working

#!/bin/sh
vpnclient2-port-forward $dev

Any ideas?

 

[john9527]

I call it explicitly with
sh vpnclient2-port-forward $dev

and spell 'forward' correctly (not 'forwad')

 

[waeking]

I call it explicitly with
sh vpnclient2-port-forward $dev

and spell 'forward' correctly (not 'forwad')

It is nice to have some fresh eyes to see somethings that are so obvious.
Thanks I had it correct on the router just not here on the forum. I have also change call it with
sh vpnclient2-port-forward $dev
still not working, seems as though it is still not waiting. I can still run ./vpnclient2-port-forward tun12 after and it will take a new port.

 

[john9527]

Try to simplify first....
try replacing all the ping check code with just a
sleep 5
(that's what I'm currently using for my STUN problem)

Then, if you want to refine further.....make the check wait until
$(nvram get vpn_client2_state) == 2

 

[waeking]

I can't seem to get the sleep to work even at sleep 30 at the beginning. If I add sleep 5 after a successful ping and then curl. I can run a command like this sucessfully

service restart_vpnclient2 && ./vpnclient2-port-forward tun12

however I still cannot get anything to run when called just with sh vpnclient2-port-forward $dev in vpnclient2-route-up.

could you elaborate on the $(nvram get vpn_client2_state) == 2

while ! echo $(nvram get vpn_client2_state) == 2; do sleep 1; done

something like this?

Almost seems as thought the route up script waits until the port-forward script times out and then cancels the rest of the port forward script.

 

[john9527]

Sorry...forgot to tell you to have the script run in the background.....add an & at the end
sh vpnclient2_port_forward $dev &

For the better test, try this

while [ "$(nvram get vpn_client2_state)" != "2" ]; do
        sleep 1
done

 

[waeking]

Well this is embarrassing.... What is needed to do was correct the path to the script
instead of calling sh vpnclient2-port-forward. I had to call sh/jffs/scripts/vpnclient2-port-forward &
I am not sure why that would make a difference when they are in the same location. But all is working now.

Thanks so much!

 

[waeking]

For Future People
vpnclient2-port-forward

Spoiler

#!/bin/sh
# vpnclient2-port-forward
#
# Need to install the following
# opkg install coreutils-sha256sum
# opkg install transmission-remote-openssl
#
# Enable port forwarding when using Private Internet Access
# And change the port in transmission
#
TRANSUSER=USER
TRANSPASS=PASSWORD
TRANSHOST=IP1
TRANSGUI=IP2
TRANSPORT=IP1PORT

#wait for tunnel to be up
## CHANGE vpn_clientX_state to correct tunnel
state="vpn_client"`echo $dev|cut -c5`"_state"
while [ "$(nvram get $state)" != "2" ]; do
        sleep 1
done
#port_forward_assignment
CLIENT_ID=`head -n 100 /dev/urandom | sha256sum | tr -d " -"`
forwarded_port=$(curl --interface $dev "http://209.222.18.222:2000/\?client_id=$CLIENT_ID" 2>/dev/null | awk -F ':' '{ print $2 }'| awk -F '}' '{ print $1 }')
# delete old port from file and add new port
PORT=$forwarded_port
echo $PORT > /tmp/mnt/Merlin/openvpn.d/port.forward
echo "Creating New Forwarding rules for port:"$PORT" on device "$dev" and forwading to "$TRANSHOST
        iptables -I FORWARD -i $dev -p udp -d $TRANSHOST --dport $PORT -j ACCEPT
        iptables -I FORWARD -i $dev -p tcp -d $TRANSHOST --dport $PORT -j ACCEPT
        iptables -t nat -I PREROUTING -i $dev -p udp --dport $PORT -j DNAT --to-destination $TRANSHOST
        iptables -t nat -I PREROUTING -i $dev -p tcp --dport $PORT -j DNAT --to-destination $TRANSHOST
#transmission_change_port
transmission-remote $TRANSGUI:$TRANSPORT --auth $TRANSUSER:$TRANSPASS --port $PORT

vpnclient2-route-up

Spoiler

#!/bin/sh
sh /jffs/scripts/vpnclient2-port-forward $dev &

vpnclient2-route-down

Spoiler

#!/bin/sh
PORT=$(cat/tmp/mnt/Merlin/openvpn.d/port.forward)
TRANSHOST=IP1
#iptables_old_port_forward
        iptables -D FORWARD -i $dev -p udp -d $TRANSHOST --dport $PORT -j ACCEPT
        iptables -D FORWARD -i $dev -p tcp -d $TRANSHOST --dport $PORT -j ACCEPT
        iptables -t nat -D PREROUTING -i $dev -p udp --dport $PORT -j DNAT --to-destination $TRANSHOST
        iptables -t nat -D PREROUTING -i $dev -p tcp --dport $PORT -j DNAT --to-destination $TRANSHOST