Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Email Notification - OpenVPN Client Connect (Common Name)

    Scheduled Pinned Locked Moved OpenVPN
    138 Posts 20 Posters 44.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bingo600B
      bingo600 @noplan
      last edited by bingo600

      @noplan said in Email Notification - OpenVPN Client Connect (Common Name):

      @bingo600

      and what does the output look like ?

      I just added the called filename to the output.
      And fixed the "stringcompare"

      Rest is the same.

      Credit for the script & decoding the env vars , should go to the original authors.

      /Bingo

      If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

      pfSense+ 23.05.1 (ZFS)

      QOTOM-Q355G4 Quad Lan.
      CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
      LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

      1 Reply Last reply Reply Quote 0
      • ArmstrongA
        Armstrong @noplan
        last edited by Armstrong

        This post is deleted!
        1 Reply Last reply Reply Quote 0
        • N
          newnub
          last edited by

          Apparently there is a bug with FreeRADIUS and Assigned IPv4 Address for your OpenVPN if you use the email script by adding it to:
          OpenVPN Server -> Advanced Configuration > Custom Options

          If you invoke script from Custom Options under OpenVPN Server -> Advanced Configuration, then FreeRADIUS will no longer assign your static IPv4 for OpenVPN. I don't know how to get around this but just FYI if suddenly your OpenVPN IP is no longer your defined static address.

          1 Reply Last reply Reply Quote 0
          • S
            Stewart
            last edited by

            I know this thread is kinda old but I don't know that starting a new topic is the best course of action. I'm trying to implement this but there is a delay of a couple of minutes on the disconnect script and the connect script won't log if it's waiting for the disconnect script.

            In the Advanced Configuration -> Custom Options I have:
            4903d91c-ea9c-4230-aabb-06cf015d6a80-image.png

            I've modified the scripts to both send an email and output to a log file when run. When a client connects, I see the log file updated immediately and the email comes very quickly. When a client disconnects it takes 2 -2.5 minutes before the log file is updated and the email is sent. During that window of time if I reconnect it doesn't log or send an email. There is very little difference in the two scripts at this point as I try to narrow down the issue.

            Does anyone have any idea what this delay is and what's going on?

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @Stewart
              last edited by Gertjan

              @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

              kinda old

              Nothing changed.

              07ec1a8f-3e67-4158-b8a4-d233bc6da969-image.png

              My /root/notify.sh file :

              #!/usr/local/bin/php -q
              <?php
              	require_once("/etc/inc/notices.inc");
              	$local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " on " . date('F j, Y, g:i a');
              	log_error("About to send a mail : Connecting");
              	notify_all_remote($local_connect_value);
              ?>
              

              The disconnect.sh file :

              #!/usr/local/bin/php -q
              <?php
              	require_once("/etc/inc/notices.inc");
              	$local_connect_value .= ", during : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNRECTED.";
              	log_error("About to send a mail : Disconnecting");
              	notify_all_remote($local_connect_value);
              ?>
              

              The files :

              ls -al *.sh
              -rwxr-xr-x  1 root  wheel  353 Sep  8 08:13 disconnect.sh
              -rwxr-xr-x  1 root  wheel  316 Sep  8 08:14 notify.sh
              

              I connected to my pfSense VPN server, and disconnected a couple of seconds later.

              My centralized syslog server showed :

              ...
              2021-09-08 08:21:32	User.Error	pfsense	1 2021-09-08T08:21:35.264334+02:00 pfsense.my-network.tld php 15669 - - /root/notify.sh: About to send a mail : Connecting
              2021-09-08 08:21:35	User.Error	pfsense	1 2021-09-08T08:21:37.728863+02:00 pfsense.my-network.tld php 15908 - - notify_monitor.php: Message sent to my-gmail@gmail.com OK
              ....
              2021-09-08 08:21:49	User.Error	pfsense	1 2021-09-08T08:21:52.325734+02:00 pfsense.my-network.tld php 16254 - - /root/disconnect.sh: About to send a mail : Disconnecting
              2021-09-08 08:21:51	Daemon.Warning	pfsense	1 2021-09-08T08:21:54.188458+02:00 pfsense.my-network.tld radvd 93362 - - sendmsg: Permission denied
              2021-09-08 08:21:56	User.Error	pfsense	1 2021-09-08T08:21:58.979760+02:00 pfsense.my-network.tld php 15908 - - notify_monitor.php: Message sent to my-gmail@gmail.com OK
              ....
              

              You can also use a console or SSH session, and execute :

              tail -f /var/log/system.log
              

              to see real time system log events.

              Logs lines showed up instantly.
              I received the mails.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              S 1 Reply Last reply Reply Quote 0
              • S
                Stewart @Gertjan
                last edited by

                @gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

                @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

                kinda old

                Nothing changed.

                I only mentioned it because I'm always wary of necroposting and people getting upset. I'm sure it isn't the scripts themselves. Even if I have client-connect and client-disconnect call the same script the delay is still there. Would it matter if the OpenVPN server is set to Remote Access (SSL/TLS + User Auth) and authenticated by the Active Directory?

                GertjanG 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @Stewart
                  last edited by

                  @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

                  Even if I have client-connect and client-disconnect call the same script the delay is still there.

                  I was using the same file for the connect / disconnect event, but @bingo600 has a point - see above.
                  The OpenVPN connect and disconnect are instantaneously for me.

                  I'm using myself SSL/TLS only.
                  Authentication (using AD) only happens when the user logs in.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    Stewart @Gertjan
                    last edited by

                    @gertjan

                    I'm using different scripts for each event but tried it with the same script to rule it out.

                    1 Reply Last reply Reply Quote 0
                    • S
                      Stewart
                      last edited by

                      Progress! I've found that if I add
                      explicit-exit-notify
                      to the client then it populates immediately. I guess that without it then it's waiting for a timeout period before it disconnects the session.

                      Since we have a lot of clients out there already, is there a way to add this to the VPN server config? Or does it have to be manually entered into every client? I've tried adding into the server Custom Options but it doesn't work.

                      GertjanG JeGrJ 2 Replies Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @Stewart
                        last edited by

                        @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

                        Progress! I've found that if I add
                        explicit-exit-notify
                        to the client then it populates immediately.

                        Client ?
                        These are OpenVPN server 'custom' command options.
                        At least, they are in the context of this forum thread.
                        You can see the doc here : https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html

                        You are using OpenVPN 2.5.x, right ? And UDP tunnnels ?

                        @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

                        I've tried adding into the server Custom Options but it doesn't work.

                        As above, see again :

                        895edba3-c141-4997-9730-f656f7b80141-image.png

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • JeGrJ
                          JeGr LAYER 8 Moderator @Stewart
                          last edited by

                          @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

                          Progress! I've found that if I add
                          explicit-exit-notify
                          to the client then it populates immediately. I guess that without it then it's waiting for a timeout period before it disconnects the session.

                          It is. For UDP clients you have to wait your configured timeout period (normally ~60-90s) for the disconnect script to get executed as the server doesn't see the client disconnecting. Explicit-exit-notify on the client fixes that by alerting the server of the clients disconnect wish.

                          Don't forget to upvote šŸ‘ those who kindly offered their time and brainpower to help you!

                          If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                          GertjanG 1 Reply Last reply Reply Quote 1
                          • GertjanG
                            Gertjan @JeGr
                            last edited by

                            @jegr Aha !! I get it.
                            I was disconnecting manually my client, by sliding the on/off button in the client while testing.
                            That probably makes the sending a "connection down" to the server, so there were no delays for me doing such a test.

                            When the client looses the connection because of bad data reception (Wifi or data carrier like 4G5G) then the server would apply a wait period before it fires a "client-disconnect" cmd.

                            @JeGr Thanks for making that clear.

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            JeGrJ 1 Reply Last reply Reply Quote 0
                            • JeGrJ
                              JeGr LAYER 8 Moderator @Gertjan
                              last edited by

                              @gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

                              I was disconnecting manually my client, by sliding the on/off button in the client while testing.

                              Yes, but without explicit-exit-notify UDP clients don't inform the server of their disconnect. So the server just stops getting traffic, waits for the tiemeout/keepalive time and then internally de-registers the client as unavailable/disconnected and runs the script.
                              TCP clients don't have that problem because of TCP (d'uh! ;)) and explicit-exit-notify brings that to UDP - but with its own problems (e.g. mixed style multi-configs with udp&tcp remote statements for automatic fallback etc. aren't possible ATM).

                              As I did a bit of an updated version of that script for noplan, I tested around that myself and could see that behavior every time. One just has to be patient :)

                              Cheers
                              \jens

                              Don't forget to upvote šŸ‘ those who kindly offered their time and brainpower to help you!

                              If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                              GertjanG S 2 Replies Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @JeGr
                                last edited by

                                @jegr said in Email Notification - OpenVPN Client Connect (Common Name):

                                Yes, but without explicit-exit-notify UDP clients don't inform the server of their disconnect

                                See above what I have in the custom options.
                                My connection plain vanilla : is UDP based, port 1194 etc.

                                I connect, I wait 20+ seconds, and then I slide the connection connection on my iPhone - OpenVPN Connect App to off, I see this line immediately in the pfSense OpenVPN server log :

                                f8a8ac00-8802-4c22-8dcf-c195bdf4ca36-image.png

                                You can clearly see the 25 seconds delay.

                                gmail also notifies me immediately on both events.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Stewart @JeGr
                                  last edited by

                                  @jegr said in Email Notification - OpenVPN Client Connect (Common Name):

                                  @gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

                                  I was disconnecting manually my client, by sliding the on/off button in the client while testing.

                                  Yes, but without explicit-exit-notify UDP clients don't inform the server of their disconnect. So the server just stops getting traffic, waits for the tiemeout/keepalive time and then internally de-registers the client as unavailable/disconnected and runs the script.
                                  TCP clients don't have that problem because of TCP (d'uh! ;)) and explicit-exit-notify brings that to UDP - but with its own problems (e.g. mixed style multi-configs with udp&tcp remote statements for automatic fallback etc. aren't possible ATM).

                                  As I did a bit of an updated version of that script for noplan, I tested around that myself and could see that behavior every time. One just has to be patient :)

                                  Cheers
                                  \jens

                                  My problem with being patient is that while waiting no other script will launch. So if someone connects or disconnects within that 90 second window (or whatever that window may be) the scripts don't launch. At least, that's what it appears is happening. I don't see a reason why it would be that way, though.

                                  noplanN 1 Reply Last reply Reply Quote 0
                                  • noplanN
                                    noplan @Stewart
                                    last edited by

                                    @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

                                    while waiting no other script will launch. So if someone connects or disconnects within that 90 second window (or whatever that window may be) the scripts don't launch.

                                    r u sure ?
                                    cuz we don't see it ... have tested after reading your post ... can't confirm it.
                                    brNP

                                    S 1 Reply Last reply Reply Quote 0
                                    • S
                                      Stewart @noplan
                                      last edited by

                                      @noplan said in Email Notification - OpenVPN Client Connect (Common Name):

                                      @stewart said in Email Notification - OpenVPN Client Connect (Common Name):

                                      while waiting no other script will launch. So if someone connects or disconnects within that 90 second window (or whatever that window may be) the scripts don't launch.

                                      r u sure ?
                                      cuz we don't see it ... have tested after reading your post ... can't confirm it.
                                      brNP

                                      Maybe it's because I'm using the same user over and over to test? When I connect the first time the log gets generated (I have the script writing to a log file instead of emailing). After that, I can connect and disconnect and no other lines are written to the log file. Not even the first disconnect gets written. If I wait until after the disconnect line gets written then I can connect and the line gets logged.

                                      noplanN ArmstrongA 2 Replies Last reply Reply Quote 0
                                      • noplanN
                                        noplan @Stewart
                                        last edited by

                                        @stewart

                                        sounds interesting

                                        a) use a 2nd user
                                        b) connect with user 1
                                        c) connect with user 2 when user 1 is connected
                                        d) disconnect user 1
                                        e) shortly after done d) disconnect user 2

                                        both users are written in your file ?

                                        be so kind and show us logFile and script
                                        brNP

                                        S 1 Reply Last reply Reply Quote 0
                                        • ArmstrongA
                                          Armstrong @Stewart
                                          last edited by

                                          @stewart

                                          Are you perhaps experiencing the same thing I was in this post https://forum.netgate.com/post/897352 ?

                                          The disconnect lags well behind the actual disconnection.

                                          S 1 Reply Last reply Reply Quote 0
                                          • S
                                            Stewart @noplan
                                            last edited by

                                            @noplan said in Email Notification - OpenVPN Client Connect (Common Name):

                                            @stewart

                                            sounds interesting

                                            a) use a 2nd user
                                            b) connect with user 1
                                            c) connect with user 2 when user 1 is connected
                                            d) disconnect user 1
                                            e) shortly after done d) disconnect user 2

                                            both users are written in your file ?

                                            be so kind and show us logFile and script
                                            brNP

                                            I'll get a second pc up and running to test with. It'll take a few.

                                            S 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.