Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I associate a script to OpenVPN so that it runs when the VPN is connected successfully?

share|improve this question
In the case of the client I guess? What software are you using? OpenVPN, or a wrapper (e.g. NetworkManager)? – Lekensteyn Mar 2 '11 at 16:27
@Lekensteyn, wrapper network-manger-openvpn. – Oxwivi Mar 2 '11 at 17:29
up vote 35 down vote accepted

network-manager-openvpn does not provide such functionality, you have to use openvpn directly.

Pass --script-security 2 --up /path/to/your/script to it when connecting. If you're using a configuration file located at /etc/openvpn/, append the next lines to your configuration file:

script-security 2
# run /etc/openvpn/ when the connection is set up
up /etc/openvpn/

From the OpenVPN manpage:

--script-security level [method]
              This  directive offers policy-level control over OpenVPN’s usage
              of external programs and scripts.  Lower level values  are  more
              restrictive,  higher  values  are more permissive.  Settings for

              0 -- Strictly no calling of external programs.
              1 -- (Default) Only call built-in executables such as  ifconfig,
              ip, route, or netsh.
              2  --  Allow  calling  of  built-in executables and user-defined
              3 -- Allow passwords to be passed to scripts  via  environmental
              variables (potentially unsafe).
       --up cmd
              Shell  command  to run after successful TUN/TAP device open (pre
              --user UID change).  The up  script  is  useful  for  specifying
              route  commands  which  route  IP  traffic  destined for private
              subnets which exist at the other end of the VPN connection  into
              the tunnel.
Script Order of Execution
       --up   Executed after TCP/UDP socket bind and TUN/TAP open.
       --down Executed after TCP/UDP and TUN/TAP close.

There are more events for script execution, those can be found on the manual page.

Create /etc/openvpn/, and give it execute permissions (say, 755 or 700). Example content for adding an IPv6 address and route (shown for educational purposes, do not copy it directly):

# add an IPv6 address to device $dev (environment variable)
ip -6 addr add 2001:db8::1:2/112 dev $dev
# and the IPv6 route for this net using gateway 2001:db8::1
ip -6 route add 2001:db8::1:0/112 via 2001:db8::1 dev $dev

Note that this up script is run as root. If you have not specified a User and Group setting, OpenVPN will run scripts like down as root too.

share|improve this answer
If you do not know how to use openvpn directly, add your current configuration details: Connection type (e.g. X509-certificates), Gateway port, LZO-compression, force of TCP, use of tap device, cipher, HMAC and TLS. Mention your IP settings too if they are not automatic. FOr your privacy, leave out your actual addresses. – Lekensteyn Mar 2 '11 at 18:39
Okay fine, I decided to use OpenVPN directly (and yes, I do have the .conf file), but will it automatically reconnect if the connection is lost? And how do I make it connect automatically whenever there's internet connection? And finally, I did not understand where I have to add the lines you mentioned in the answer. – Oxwivi Mar 5 '11 at 13:44
I have expanded the answer to use openvpn directly. When setting up a server, I noticed that OpenVPN will try to reconnect when the server went down. Not sure if OpenVPN continues trying when your network interface goes down. – Lekensteyn Mar 5 '11 at 14:26
My issue is not when network interface goes down - it does try to reconnect when internet connection is lost and regained. I just want to connect to the VPN whenever I get internet connection. – Oxwivi Mar 5 '11 at 16:09
Oh, and does the script apply to all VPN connection? And please tag @Oxwivi when replying, I won't get notified otherwise. – Oxwivi Mar 5 '11 at 16:10

this may be well known and obvious to many people, but I stuck with that for some time with no clue. Just to possibly save some time to others:

The script has to include the shell info e.g. "#!/bin/sh" to get successfully executed. Until this was there, openvpn kept complaining "script failed: could not execute external program" even though the script was there with all the executable flags and everything.

Rgrds, Jiri

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.