Connect Script#

TODO: write a proper Go example instead of shell script

TODO: none of this has been tested, it just examples, but this is more or less how it will work

A script can be configured that is called before a VPN client configuration is returned to a VPN client.

In its most simple form the script returns the VPN client configuration that it obtains through the VPN_CLIENT_CONFIG environment variable without taking any other action.

The examples below will use the jq and jo CLI tools. They are available as packages in most distributions.

#!/bin/sh
if [ "${VPN_EVENT}" = "CONNECT" ]; then
    echo "${VPN_CLIENT_CONFIG}"
fi

However, the script can also be used to modify the VPN client configuration before it is returned to the VPN client. For example, a silly example customizes the MTU:

#!/bin/sh
if [ "${VPN_EVENT}" = "CONNECT" ]; then
    echo "${VPN_CLIENT_CONFIG}" | jq '.MTU=1392'
fi

In addition to the VPN client configuration, the script has access to the following environment variables:

On	Variable Name	Purpose
C/D	`VPN_EVENT`	Indicates whether this is a `CONNECT` or `DISCONNECT` event
C/D	`VPN_USER_INFO`	The `UserInfo` object (JSON encoded)
C	`VPN_PROFILE_CONFIG`	The `ProfileConfig` object (JSON encoded)
C	`VPN_NODE_CONFIG`	The `NodeConfig` object (JSON encoded)
D	`VPN_PEER_INFO`	The `PeerInfo` object (JSON encoded)

As another silly example, as this can also be handled by the “permission” system in the VPN server, but if the user is not “jane”, reject the connection:

#!/bin/sh
if [ "${VPN_EVENT}" = "CONNECT" ]; then
    USER_ID=$(echo ${USER_INFO} | jq -r .user_id)
    if ! [ "jane" = "${USER_ID}" ]; then
        jo error="user 'jane' is not allowed to connect"
        exit 1
    fi
    echo "${VPN_CLIENT_CONFIG}"
fi

If you want to assign IPs to the VPN client configuration yourself, you can do that as well. You MUST have your own IP registery of course, as to not issue to same IP more than once before it is freed by the DISCONNECT event.

NOTE: you MUST disable autoPrefixAssignment in the VPN profile configuration for which you want to assign your IPs manually.

#!/bin/sh
if [ "${VPN_EVENT}" = "CONNECT" ]; then
    USER_ID=$(echo ${USER_INFO} | jq -r .user_id)
    PROFILE_ID=$(echo ${PROFILE_CONFIG} | jq -r .profileId)
    if [ "${USER_ID}" = "jane" ] && [ "${PROFILE_ID}" = "1bbbf227-3859-461f-be2c-ed97cbd6fc59"]; then
        IP_4="10.10.10.99/32"
        IP_6="fd10::99/128"
        echo "${VPN_CLIENT_CONFIG}" | jq ".IPv4=${IP_4}" | jq ".IPv6=${IP_6}"

        exit
    fi

    jo error="only user 'jane' connecting to profile '1bbbf227-3859-461f-be2c-ed97cbd6fc59' is handled"
    exit 1
fi

If you want to log events, that is possible too:

#!/bin/sh
if [ "${VPN_EVENT}" = "CONNECT" ]; then
    USER_ID=$(echo ${USER_INFO} | jq -r .user_id)
    IP_4=$(echo ${VPN_CLIENT_CONFIG} | jq -r .IPv4)
    IP_6=$(echo ${VPN_CLIENT_CONFIG} | jq -r .IPv6)
    logger "CONNECT ${USER_ID} ${VPN_PROFILE_ID} ${IP_4} ${IP_6}"
fi

if [ "${VPN_EVENT}" = "DISCONNECT" ]; then
    USER_ID=$(echo ${USER_INFO} | jq -r .user_id)
    IP_4=$(echo ${PEER_INFO} | jq -r .IPv4)
    IP_4=$(echo ${PEER_INFO} | jq -r .IPv6)
    logger "DISCONNECT ${USER_ID} ${VPN_PROFILE_ID} ${IP_4} ${IP_6}"
fi