1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

SSH command to control "Block routed clients if tunnel goes down"?

Discussion in 'Asuswrt-Merlin' started by cw-kid, Oct 24, 2018.

Tags:
  1. cw-kid

    cw-kid Occasional Visitor

    Joined:
    Oct 24, 2018
    Messages:
    36
    Hello

    I am setting up my Home Automation controller to send SSH commands to my Asus Merlin router to control somethings.

    I have managed to gain control over the VPN client connection and can turn it on and off via LUA code in my scenes.

    For example using a command such as

    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] service stop_vpnclient1")

    Can the option in the Merlin firmware "Block routed clients if tunnel goes down" also be turned on or off via a SSH command ?

    Thanks
     
    Mihai likes this.
  2. Martineau

    Martineau Part of the Furniture

    Joined:
    Jul 8, 2012
    Messages:
    3,333
    Location:
    UK
    Set the appropriate NVRAM variable
    Code:
    nvram show 2>/dev/null | grep -E "vpn_client[1-5]_enforce" | sort
    so if they are all set to "0'' (Block routed clients if tunnel goes down=NO), you can alter the setting

    e.g. to set 'Block routed clients if tunnel goes down=YES' for VPN Client 1 enter:
    Code:
    nvram set vpn_client1_enforce="1"
    
    nvram commit
     
    Last edited: Oct 24, 2018
  3. cw-kid

    cw-kid Occasional Visitor

    Joined:
    Oct 24, 2018
    Messages:
    36
    Hi Martineau

    Thank you for your help !

    I have just tried what you said in PUTTY and it works, it does turn on and off that setting.

    I just need to work out how to send those commands from my HA Controller now in LUA code.

    Thanks
     
  4. cw-kid

    cw-kid Occasional Visitor

    Joined:
    Oct 24, 2018
    Messages:
    36
    If I send this command from my HA Controller it works and turns on the "Block routed clients if tunnel goes down" option.

    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] nvram set vpn_client5_enforce=1")

    Do I also need to send the "nvram commit" command ?

    This command turns that option off:

    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] nvram set vpn_client5_enforce=0")

    Thanks
     
  5. Martineau

    Martineau Part of the Furniture

    Joined:
    Jul 8, 2012
    Messages:
    3,333
    Location:
    UK
    The 'commit' will force the router to remember the setting, so if you set the variable to "1" (and didn't 'commit'), if you then had a power outage and the router rebooted, the variable will be reset to the router default of "0" rather than "1" which may not be what you desire.
     
  6. cw-kid

    cw-kid Occasional Visitor

    Joined:
    Oct 24, 2018
    Messages:
    36
    Martineau

    OK thanks that makes sense.

    So in my HA Controller scenes I now have the following lines of code:

    VPN On:

    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] nvram set vpn_client5_enforce=1")
    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] nvram commit")
    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] service start_vpnclient5")

    VPN Off:

    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] nvram set vpn_client5_enforce=0")
    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] nvram commit")
    os.execute("ssh -y -i ~/.ssh/id_dss [email protected] service stop_vpnclient5")

    It seems to work and it turns on or off the VPN client connection and now also turns on or off the "Block routed clients if tunnel goes down" setting.
     
    Martineau likes this.
  7. Martineau

    Martineau Part of the Furniture

    Joined:
    Jul 8, 2012
    Messages:
    3,333
    Location:
    UK
    May I ask which HA Controller you are using?
     
  8. cw-kid

    cw-kid Occasional Visitor

    Joined:
    Oct 24, 2018
    Messages:
    36
    A Vera Plus Z-Wave controller.

    I wanted to add a virtual switch in to Vera and into the mobile control app we use Imperihome, to be able to turn the VPN client connection on and off. I managed to get that working see here.

    But then I wanted to add some extra control over this "Block routed clients if tunnel goes down" setting.
     
    Martineau likes this.
  9. cw-kid

    cw-kid Occasional Visitor

    Joined:
    Oct 24, 2018
    Messages:
    36
    Martineau

    I've added your instructions for this on to the thread in the Vera forum as well.

    Thanks again !