OpenVpn + MultiWan

[Valeriy]

Hello. Tell me how to use OpenVpn when switching MultiWan? The ip address changes and you can’t connect via openvpn. Can I set up a backup openvpn?

[mrmarkuz (Markus Neuberger)]

You could use the name instead of the ip address in the VPN config. You may use ddclient to send your current IP to a dyndns provider.

I think it’s also possible to setup a backup openvpn using the second IP and another port.

[pike (Michael Kicks)]

@Valeriy

Can I set up a backup openvpn?

@mrmarkuz

I think it’s also possible to setup a backup openvpn using the second IP and another port.

AFAIK it’s possible only for Net to net connections (multiple servers), not for roadwarrior.

Which currently is a “one server only” option and expects connections only from the specified RED interface (which should be connected to one public ip only)

[mrmarkuz (Markus Neuberger)]

@pike

AFAIK it’s possible only for Net to net connections (multiple servers), not for roadwarrior.

It’s not possible in server manager but it’s possible:

Multiple OpenVPN Server

@Denis_Pollini As @Andy_Wismer pointed out above, you have to manage any other OpenVPN instances outside of the UI. All the information you need is above. You need to put the .conf file in the /etc/openvpn/server directory and then use systemctl to control it. Oh, and you need to open the port in the red interface. Cheers.

[pike (Michael Kicks)]

Thanks for reminding that option, mrmarkuz.
Tackling at linux level anyway is not the same that configuring server on Cockpit.

[Valeriy]

But how can I manage systemctl if I don’t have access to the server? openvpn has disconnected and remotely I can’t switch to another openvpn.

[mrmarkuz (Markus Neuberger)]

If you need CLI you could connect to the second IP via SSH but I think “switching” VPN isn’t necessary.

If you use the name ddclient method, the VPN should just work after the second IP has been published. Instead of using dyndns, if you have the possibility to set DNS entries, you could set the priority to fallback to the second IP.

If you use the backup VPN method, you could just connect to the backup VPN that runs on another port if the primary VPN fails.

[Valeriy]

Tell me how to configure the second openvpn server on a different port?

[mrmarkuz (Markus Neuberger)]

Basically I think it’s copy the vpn config, change port and IP, create a service and enable it.
I never tested it but I can share the steps later.

EDIT:

Wouldn’t it be easier to just copy the profile on the client and change the IP address to the second IP? This way you don’t need to customize the server and you need a second profile on the clients anyway.