Skip to content

Do not activate OpenVPN client connection right after adding config

New openvpn client connection is marked as enabled and immediately started after adding (after openvpn restart).

https://gitlab.nic.cz/turris/foris-controller/foris-controller-openvpn_client-module/-/blob/master/foris_controller_backends/openvpn_client/init.py#L90

This is quite dangerous, because adding new vpn client config could make router inaccessible without simple way to disable such vpn client.

It could be done either by malformed config, overlapping addresses range on vpn client's LAN and vpn server's LAN or just unexpected behaviour (see turris/os/packages#823 (closed)).

It would be safer to make activation of vpn client into two steps:

  1. upload client config
  2. activate vpn client connection
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information