Messages

ok, honestly i don't know why that would happen.  I can only suggest that something went weird when you pasted it.

maybe just recreate the script file and paste it in again from my text.  ?

erm, give me a screenshot of your script as it looks in nano. 
also the output of ls -la proxyipupdate.sh

160 views and noone can be arsed to reply :-(  such a shame that the only people who seem to reply to things are the devs, when they see fit.

as title says really.  any changes to /usr/local/etc/squid/squid.conf get overwritten on system updates/changes in the GUI.  I want to add something (specifically tcp_outgoing_address) that needs to be persistently in there. (doesn't appear to be a GUI option to set this).

I've read something about pre-auth and post-auth folders but from looking at whats in them currently, the contents of such doesn't seem to appear in the squid.conf file so i dont think it works like that.   Plus those folders seem to be very specifically relating to opnsense and I cannot find any documentation on them.

Please advise.

Thanks

ah ok, in that case i'll look to adding to pre/post conf files then.  will investigate.  does your squid config contain any tcp outgoing address line at all though? as if not then i suspect that it hasnt worked. and if it doesnt exist in the squid config then the script doesnt 'add' it, it only 'changes' it.

ok managed to get it up and running again. 
if the tcp_outgoing_address line isnt already in the squid config then the script doesnt do anything.  if it is in there then it changes the ip correctly. just tested.  do you have it in there right now to start with?  i certainly don't get any errors when running the script.
not sure on which circumstances that the config file goes back to 'default' though.   again.  someone with more brains than i might hopefully explain this and the previous questions.

i didnt do anything with the pre/post config folders. 
i just looked again in the squid config file and it doesn't have the setting in there for sending to a specific IP interface.  but seeings as my vpn tunnel isn't actually working, I can't really test any further.  so until then i'm going to have to bow out.  I've raised a support ticket with my vpn provider as its not working on on my phone either so there is def an issue somewhere.

will come back when i can

nope i didn't change anything as far as i remember.  you have created an interface for your client vpn, right? I'm not even sure what you have or haven't already done.

in system > interfaces > assignments... .do you have a vpn interface you created in there with the name ovpnc1 or something?  make sure that same name is what is referred to in the script variable at the top

just noticed you are running it as a transparent proxy.  not sure if that works differently or not.   i would hope someone else pipes in here but this forum is like pretty dead when it comes to other people helping. :(  kinda have to rely on the main dev checking out every post, which isn't fair on him really

ok i just did the same but created a new file instead of using an old one.  hopefully that survives a system update.

so i basically

Code Select Expand


nano /usr/local/opnsense/service/conf/actions.d/actions_custom.conf

pasted the following

Code Select Expand


[squidvpnproxy]
command: /root/vpnscript.sh
parameters:
type:script
message: reload proxy with vpn interface
description: VPN via Proxy script


, saved and restarted.
checked and the option is back again.  will remember to check it exists again next time i get a system update.

now to try to fix my vpn ....... :(

i have edited one of the "action...." files and added a command to run a script.  which was working.  but this file just got overwritten by a opnsense system update (just a minor one).   how can we go about making these changes survive such an update?

****DON'T DO THIS, CHECK NEXT POST*****
ok i sorted it , but my vpn isnt connecting so i can't test it.

edit /usr/local/opnsense/service/conf/actions.d/actions_proxy.conf

added a section 

Code Select Expand


[squidvpnproxy]
command: /root/vpnscript.sh
parameters:
type:script
message: reload proxy with vpn interface
description: VPN via Proxy script


then restarting the configd service

Code Select Expand

service configd restart
and then i could choose that from the cron job drop down.

only problem is that I have also just ran an update on my firewall and it seems to have overwritten that file.  my changes no longer exist.

i think someone cleverer might have to chime in with regards to making the changes more permanent.

was connecting fine before. now it never connects.

log files say

Code Select Expand


2022-03-08T12:22:17 Notice openvpn UDP link remote: [AF_INET]1xx.1xx.6x.98:8888
2022-03-08T12:22:17 Notice openvpn UDP link local (bound): [AF_INET]86.x.x.24:0
2022-03-08T12:22:17 Notice openvpn TCP/UDP: Preserving recently used remote address: [AF_INET]1xx.1xx.6x.98:8888
2022-03-08T12:22:17 Warning openvpn NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2022-03-08T12:22:17 Warning openvpn WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2022-03-08T12:22:17 Notice openvpn library versions: OpenSSL 1.1.1m 14 Dec 2021, LZO 2.10
2022-03-08T12:22:17 Notice openvpn OpenVPN 2.5.5 amd64-portbld-freebsd13.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jan 24 2022
2022-03-08T12:22:17 Warning openvpn WARNING: file '/var/etc/openvpn/client1.up' is group or others accessible
2022-03-08T12:22:17 Warning openvpn DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2022-03-08T12:22:17 Notice openvpn SIGTERM[hard,] received, process exiting
2022-03-08T12:22:17 Error openvpn event_wait : Interrupted system call (code=4)

nothing has changed config-wise.

any ideas?

honestly don't know how to add it as a 'custom script' in that cron menu or if you can place the script somewhere for it to be recognised in that list.  I guess someone with more knowledge will have to chime in as i have not yet attempted to do this yet but will be at some point.

if you work it out, let me know :-)

run the script by putting it in a txt file and changing the permissions to allow it to be executable.   then run it by ./scriptname.sh or whatever its called.

cron job. not sure how its managed in opnsense as i've not looked into it. but cron is pretty simple to use anyway its just a matter of defining when you want it to run. and there are a bunch of calculators on the net to do that.

edit:  just checked and there is a cron section in the gui.   should be pretty straight foward then

sorry about the delay, I've been laid up, ill for the last week :-(

Code Select Expand





# Variables
VPN_IFACE=ovpnc1
SQUID_CONFIG_FILE=/usr/local/etc/squid/squid.conf

# Get current IP address of VPN interface
VPN_IFACE_IP=$(ifconfig $VPN_IFACE | awk '{print $2}' | egrep -o '([0-9]+\.){3}[0-9]+')

# Check if VPN interface is up and exit if it isn't
if [ -z "$VPN_IFACE_IP" ]
then
        exit 0;
fi

# Check current IP for VPN interface in squid.conf file
VPN_CONFIG_IP=$(grep -m 1 "tcp_outgoing_address" $SQUID_CONFIG_FILE | awk '{print $2}' | egrep -o '([0-9]+\>

# Check if the config file matches the current VPN interface IP, and if so exit script
if [ "$VPN_IFACE_IP" == "$VPN_CONFIG_IP" ]
then
        exit 0;
fi

# Replace the previous IP address in the squid.conf file with the current VPN interface address
sed -ie 's/'"$VPN_CONFIG_IP"'/'"$VPN_IFACE_IP"'/' $SQUID_CONFIG_FILE

# Force reload of the new squid.conf file
/usr/local/sbin/squid -k reconfigure






I run this and works fine and straight away without having to restart services afterwards too.
I've not cron'd it yet, but likely will and get it to do it ever hour or something