How can I fully restart an IPsec tunnel from commandline?

[Colani1200]

Hi all,

before I start digging in source code, can anybody tell me what the "play/stop" buttons on the "VPN: IPsec: Status Overview" page exactly trigger? I sometimes have problems with a specific connection and would like to restart it via monit and a script. I assumed that

Code Select Expand

ipsec down con(x); ipsec up con(x) would work, but it seems that this is not enough to fully restart that specific tunnel. Apparently the buttons on the status page do more than that, those work fine for a tunnel restart.

[zerwes]

I wrote a (quite brute) script for monit ...

Code Select Expand

#! /bin/sh
/usr/local/sbin/configctl ipsec stop
/usr/local/sbin/ipsec stop
/usr/bin/killall charon
/usr/local/sbin/configctl ipsec start
... hope it helps

[zerwes]

sorry, forgot to mention for completeness ...
I tried the soft approach first like you using the stop/start command directly like you did

Code Select Expand

ipsec down con1-000
ipsec up con1-000
etc.... or the scripts

Code Select Expand

/usr/local/opnsense/scripts/ipsec/connect.py
/usr/local/opnsense/scripts/ipsec/disconnect.py
(these are IMHO called by the WebUI)
but I encountered some situation were a even a restart of the IPSec service did not bring the tunnel back up due to some loose and lost charon process cloged the re-connection.
So I decided to take a short interruption in the worst case for acceptable in relation to a tunnel that needs manual intervention ...

[Colani1200]

I really need to restart that specific tunnel only without causing interruptions on the others.

Code Select Expand

/usr/local/opnsense/scripts/ipsec/connect.py
/usr/local/opnsense/scripts/ipsec/disconnect.py
(these are IMHO called by the WebUI)

Thanks, this looks like what I need, will give that a try. These scripts should take e.g. con1 as argument, right?

[zerwes]

AFAIR it was con1-000 etc. ... but I wouldn't bet on that ... some bits and bytes have gone over my nerve pathways since then ...

[Colani1200]

This would mean that it is possible to start/stop single phase2 SAs. Maybe this is part of my problem. In general, the tunnel was up after doing

Code Select Expand

ipsec down con1; ipsec up con1 but some phase2 SAs were missing. Maybe I should specifically up and down them all one by one?

[zerwes]

... as I said, I ended up the "brute" way, and since I use the script above I see now problems and here no complains ...