Reboot on kill switch?

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Goto page 1, 2  Next
Author Message
Viewmax
DD-WRT Novice


Joined: 05 Jul 2021
Posts: 17

PostPosted: Tue Jul 13, 2021 14:21    Post subject: Reboot on kill switch? Reply with quote
Hello!

I have a kill switch script which is working fine:
Code:

WAN_IF=`nvram get wan_iface`
iptables -I FORWARD -i br0 -o $WAN_IF -j REJECT --reject-with icmp-host-prohibited
iptables -I FORWARD -i br0 -p tcp -o $WAN_IF -j REJECT --reject-with tcp-reset
iptables -I FORWARD -i br0 -p udp -o $WAN_IF -j REJECT --reject-with udp-reset

But in this case, I have to soft reboot DD-WRT router to re-establish OpenVPN connection.

Is it possible to automatically reboot router upon kill switch activation?

I tried to use WDS/Connection Watchdog service with 8.8.8.8, but seems it's not working, because router is not rebooting itself.

Any ideas? Thank you!
Sponsor
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 14207
Location: Texas, USA

PostPosted: Tue Jul 13, 2021 14:24    Post subject: Reply with quote
What router, what build?
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
DD-WRT Releases 2023 (PolitePol)
DD-WRT Releases 2023 (RSS Everything)

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12875
Location: Netherlands

PostPosted: Tue Jul 13, 2021 16:07    Post subject: Reply with quote
The general forum is not for asking for help see the stickies and announcements:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=54959

To get the best out of DDWRT and the forum read the forum guidelines with helpful pointers:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

If you have not already read the forum guidelines, please do !!

I will transfer this thread to the appropriate forum Smile

Suggestion: use the built-in kill switch

OpenVPN documentation: see the link in my signature at the bottom of this post.

P.S. there is no --reject-with udp-reset, furthermore nvram get wan_iface does not work reliably on all routers

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 1447
Location: Appalachian mountains, USA

PostPosted: Tue Jul 13, 2021 20:09    Post subject: Reply with quote
Also your OP suggests, at least to my addled brain, that you assume the kill switch kills your openvpn connection, necessitating a restart. It does not. It just discards any packets headed for the WAN that should be headed to the OpenVPN tunnel.
_________________
2x Netgear XR500 and 3x Linksys WRT1900ACSv2 on 53544: VLANs, VAPs, NAS, station mode, OpenVPN client (AirVPN), wireguard server (AirVPN port forward) and clients (AzireVPN, AirVPN, private), 3 DNSCrypt providers via VPN.
Viewmax
DD-WRT Novice


Joined: 05 Jul 2021
Posts: 17

PostPosted: Wed Jul 14, 2021 7:15    Post subject: Reply with quote
Sorry to all for not providing full details.

Router: Linksys AC3200
Firmware: DD-WRT v3.0-r40559 std (08/06/19)
VPN Provider: Cyberghost

I followed guide for OpenVPN DD-WRT (on Cyberghost website) and everything is working. The only problem I had is that in case of losing connection to VPN, dd-wrt router switched to direct connection which is not good for me.

Then I found that kill switch script can block direct connection in case of losing connection to VPN. I found on this forum script mentioned above and it's working. If dd-wrt router loses connection to OpenVPN, then it blocks direct connection. But in this case, I have to reboot router to get my OpenVPN connection back.

So main question, is there any solution for re-establshing OpenVPN connection without manual reboot? Automatic reboot is OK for me too.

Thank you!
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12875
Location: Netherlands

PostPosted: Wed Jul 14, 2021 8:07    Post subject: Reply with quote
Your build is old, bad and has security issues.

Cyberghost instructions are old and flawed
See my instructions for Cyberghost

Read the forum guidelines, step up to a more recent build, consult the Marvell forum for the best build.

Recent builds have a built-in kill switch, your kill switch is also not the best as outlined in my earlier post.

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Viewmax
DD-WRT Novice


Joined: 05 Jul 2021
Posts: 17

PostPosted: Wed Jul 14, 2021 9:15    Post subject: Reply with quote
egc wrote:
Your build is old, bad and has security issues.

Cyberghost instructions are old and flawed
See my instructions for Cyberghost

Read the forum guidelines, step up to a more recent build, consult the Marvell forum for the best build.

Recent builds have a built-in kill switch, your kill switch is also not the best as outlined in my earlier post.

Router in another country and probably I'll have an option to get it after 1 month. I can connect to it remotely, but can't update it's firmware.

By other words, there is no any option to reboot router via command line and only solution is to update firmware, use built-in kill switch, etc.., am I right? If so, then I need to wait when router will be in my hands. Thank you.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12875
Location: Netherlands

PostPosted: Wed Jul 14, 2021 9:53    Post subject: Reply with quote
You should update as soon as possible/feasible that is all I can say Smile
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
tedm
DD-WRT Guru


Joined: 13 Mar 2009
Posts: 555

PostPosted: Wed Jul 14, 2021 10:03    Post subject: Reply with quote
Viewmax wrote:

By other words, there is no any option to reboot router via command line and only solution is to update firmware, use built-in kill switch, etc.., am I right? If so, then I need to wait when router will be in my hands. Thank you.


yes there is another option. Quit monitoring this on the router. Find a convenient Linux server, and setup a monitoring script on that which triggers an expect script that telnets in and reboots the router.
Viewmax
DD-WRT Novice


Joined: 05 Jul 2021
Posts: 17

PostPosted: Thu Jul 22, 2021 13:40    Post subject: Reply with quote
egc wrote:
You should update as soon as possible/feasible that is all I can say Smile

Hello again Smile I got router to my hands and what I did:
1. Updated router to latest firmware v3.0-r46816 std (05/30/21)
2. Setup Cyberghost per your instruction with ticked Killswitch.

VPN connecting and working, but how can I test the killswitch? Is there any command to imitate losing connection to VPN?

Thank you.
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Thu Jul 22, 2021 17:43    Post subject: Reply with quote
If you issue the following command from a shell (telnet/ssh) ...

Code:
kill $(ps | grep [o]penvpncl | awk '{print $1}')


... it will kill the OpenVPN client process. You should then find the VPN client(s) has no internet access. At least until you either restart the OpenVPN client, or any watchdog process you may be happening to use automatically restarts it.

_________________
ddwrt-ovpn-split-basic.sh (UPDATED!) * ddwrt-ovpn-split-advanced.sh (UPDATED!) * ddwrt-ovpn-client-killswitch.sh * ddwrt-ovpn-client-watchdog.sh * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh * ddwrt-blacklist-domains.sh * ddwrt-wol-port-forward.sh * ddwrt-dns-monitor.sh (NEW!)
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12875
Location: Netherlands

PostPosted: Thu Jul 22, 2021 18:13    Post subject: Reply with quote
In addition to @eibgrad see the paragraph about the killswitch in the Openvpn client setup guide, link in my signature.
(Killswitch was developed with help and advice from @eibgrad so it must be good Smile )

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Viewmax
DD-WRT Novice


Joined: 05 Jul 2021
Posts: 17

PostPosted: Thu Jul 22, 2021 21:38    Post subject: Reply with quote
Thank you eibgrad & egc,

I found killall openvpn command in the guide and used it. After that, I lost connection to Internet and local network. I suppose it means that killswitch is working.

If so, is there any way to restart OpenVPN connection besides rebooting router manually after killswitch?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12875
Location: Netherlands

PostPosted: Fri Jul 23, 2021 7:06    Post subject: Reply with quote
Hit apply on the OVPN page
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Viewmax
DD-WRT Novice


Joined: 05 Jul 2021
Posts: 17

PostPosted: Fri Jul 23, 2021 9:58    Post subject: Reply with quote
egc wrote:
Hit apply on the OVPN page

It's still better option then full reboot, but is there anything automatic? I tried to use WDC Connection Watchdog with:
Interval - 100s
Ping timeout - 10s
IP: 008.008.008.008

But after that my router started to reboot every few minutes.
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum