OpenVPN will not run UP/DOWN Scripts - Error

WRT1900AC V1

I am try to have a static IP go through my OpenVPN VPN at all times and have all other IPs not go through the VPN.

I have got it mostly working but I cannot get the UP/DOWN scripts to work when called from OpenVPN as they should.

I used the instructions at http://beenje.github.io/blog/posts/openvpn-source-based-routing/ with my unique entries for "CONFIGURING" paragraphs 2 (N/A) and para 5 (my WAN connection but DNS OK).

The other "Source based routing" section paragraphs the paras 3&4 client IP changed but otherwise I followed the instructions.

I got it to work manually, I entered the UP/DOWN script commands manually in Putty and the client IP did go through the VPN and other IPs did not, so works for me.

The issue I have is that when I set-up OpenVPN to use the UP/DOWN scripts I get the following error in the System Log: "daemon.err openvpn(PIA_NLD_AES128)[849]: WARNING: Failed running command (--up/--down): could not execute external program"

I set via LUCI GUI the following in the OpenVPN client setup:
route-noexec
script-security 2
up /etc/openvpn/upvpn
down-pre
down /etc/openvpn/downvpn

Saved and stop/restarts multiple time to troubleshoot.

My scripts are: /etc/openvpn/upvpn and /etc/openvpn/downvpn permissions are 0777 and user group 00 (via filezilla).

Example Up script is:

#!/bin/sh

client=192.168.1.199

tun_dev=$1
tun_mtu=$2
link_mtu=$3
ifconfig_local_ip=$4
ifconfig_remote_ip=$5

echo "Routing client $client traffic through VPN"
ip rule add from $client priority 10 table vpn
ip route add $client dev $tun_dev table vpn
ip route add default via $ifconfig_remote_ip dev $tun_dev table vpn
ip route flush cache

**Question is: **

How do I get OpenVPN to execute the UP/DOWN scripts correctly in OpenWRT "LEDE-STABLE Reboot 17.01-SNAPSHOT r3267-f4fc12f / LuCI lede-17.01 branch (git-17.061.45451-2fe510b)"?

I think you are doing similar to myself and its working for me
in your pia config
keepalive 10 120

route-noexec
route-delay 2
script-security 2
up '/etc/config/route-up.sh'
down '/etc/config/route-down.sh'

up script
#!/bin/sh

echo "$dev : $ifconfig_local -> $ifconfig_remote gw: $route_vpn_gateway"

/etc/config/route-down.sh

ip route add default via $route_vpn_gateway dev $dev table 10

ip rule add from $ifconfig_local/32 table 10
ip rule add to $route_vpn_gateway/32 table 10

for y in ip -4 a|grep 'wlan0\|eth1'|grep inet|grep global|awk {'print $2'}; do
a=echo $y|sed 's/\.[0-9]*\/[0-9]*/.1/'
ip rule add from $a lookup main pref 100
b=echo $y|sed 's/\.[0-9]*\//\.0\//'
ip rule add from $b table 10 pref 101
echo "$a $b"
done

ip route flush cache

down script

#!/bin/sh

for rule in $(ip rule list |grep -v "all lookup"|awk -F ":" '{ print $1 }');do ip rule delete pref $rule;done

ip route flush table 10
ip route flush cache

Hope this helps

I admit I do not understand the commands so where do I put the static IP I want to go through the VPN?

My main problem is that OpenVPN kicks back the error:

"daemon.err openvpn(PIA_NLD_AES128)[849]: WARNING: Failed running command (--up/--down): could not execute external program"

I am not sure if it the commands that are the issue or just tha OpenVPN cannot execute any scripts.

Anyone have any ideas as to the original error?

@sammo I will try your settings and scripts and see what happens.

@sammo

I tried your settings exactly and I get the same error:

daemon.err openvpn(PIA_NLD_AES128)[27312]: WARNING: Failed running command (--up/--down): could not execute external program

I think it is not linked to the script commands themselves but permissions that OpenVPN needs to call and run any scripts. Maybe running as root or another user/group is the issue.

Anyone have any ideas?

Edit: PS Output via Putty:
28040 root 2976 S /usr/sbin/openvpn --syslog openvpn(PIA_NLD_AES128) --status /var/run/openvpn.PIA_NLD_AES128.status --cd /var/etc --config openvpn-PIA_NLD_AES128.co

If you get tired of trying to make external scripts work and try out this I'd appreciate feedback.

@ stangri - If you get tired of trying to make external scripts work and try out this I'd appreciate feedback.

I did try your routing package and it worked great for me but I had to compile an image and it was based on the latest packages that gave me a lot of disconnects and other problems not related to your package.

I went to the LEDE Stable build and it is rock solid for me but I cannot install your packages due to DNSMASQ-FULL and IPSET dependencies errors and they will not install.

I do not have enough knowledge to figure out how to overcome this problem.

So I looked for something else that was simple as I have a simple need but it seems to be complicated also with a lot of errors.

If the instructions for satisfying dependencies in README are incomplete or inaccurate, I'd appreciate some feedback.

I need to install the package dnsmasq-full prior to your routing package and when I am using LEDE Stable it will not allow me to install it due to dependencies errors.

Maybe a quick guide in the readme on how to install the required packages avoiding dependencies errors for newbie users like me?

Well, there is one I believed to be complete. What exactly did you do and what exact error did you get?