How to reset Racoon service from command line

Vorkbaard

How can I reset the Racoon service from the command line? I'd like to schedule it to reset every night as it seems to prevent a problem where certain users can make a tunnel but can't send data over it.

(I know I should look for a solution in stead of a workaround but there's some reasons I don't. I can elaborate on them if you wish.)

jimp

You could try to enable the "Prefer Old IPsec SA" option under System > Advanced. That seems to improve such situations for me when dealing with third-party devices and clients.

If you must reset racoon every night, just make up a small PHP shell script to run vpn_ipsec_configure(); and schedule it via cron.

Something like this should suffice:

/root/resetipsec.php

#!/usr/local/bin/php -q
include 'vpn.inc';

vpn_ipsec_configure();
?>

then chmod a+x /root/resetipsec.php, and try to run it. It should reset all the IPsec tunnels and restart racoon.

You can install the cron package and then add a command to run it nightly at whatever time you like.

Vorkbaard

Thanks for your response, jimp. We're using the Shrew Soft vpn client, do you count that as "third party"? I'll try the Prefer Old IPSec SA option first.

jimp

Technically yes, but I've not had any such problems with the shrew client. However, I also haven't tried to leave it connected for any length of time.

Usually I'll see this kind of thing when connecting to a device like a watchguard firebox, linksys router, etc.

Vorkbaard

I've created the script and ran it from the command line; it ran without any problems but it doesn't seem to do anything. Nothing gets logged and my connection doesn't get interrupted.

I created the exact same script you wrote up, did the chmod, ran from both SSH connection and the Command-thingie in the web gui, same result, namely nothing.

Am I missing something? Resetting the Racoon service via the Services menu tends to disconnect open tunnels. Thanks so much for your help, it's much appreciated!

/edit
Hey I found a workaround, I can use wget on my Windows server to spider the reset button. Not very elegant but it takes the pressure off.

jimp

Try this:

#!/usr/local/bin/php -q
require_once('vpn.inc');
require_once('config.inc');

vpn_ipsec_configure();
?>

I don't have a spare box with any active IPsec tunnels to try at the moment, but I can see why it might fail without that other file included. (I thought it was pulled in by one of the other files but it may not have been)

Vorkbaard

Same result, sorry. Feel free to try again and I'll happily keep testing but I understand if you have better things to do :)

Thanks again jimp!

jimp

It helps when I read the code properly… :)

This works, I tested it just now:

#!/usr/local/bin/php -q
require_once('vpn.inc');

vpn_ipsec_force_reload();
?>

Vorkbaard

Like a charm, thank you!