Scripting OpenVPN—An Overview

Another striking option of OpenVPN is its scripting capabilities. We can create our own scripts and have them called on changes of the connection state. This makes it easy to execute a special (e.g. Firewall) script any time a client connects or on similar occasions. There's almost no limit; I leave it up to you to imagine the possibilities.

The following table gives an overview over the possible interfaces where OpenVPN can be forced to execute arbitrary scripts:

Option	Occurrence
--learn-address <cmd>	When the IP of a VPN partner changes
--ipchange <cmd>	When the IP of the server has changed
--client-connect <cmd>	When a client connects
--client-disconnect <cmd>	When a client disconnects
--up <cmd>, down <cmd>	After configuration (up = starting, down = stopping) of the TUN/TAP device
--down-pre	Before shutting down the TUN/TAP device
--up-restart	When tunnels are restarted, up/down scripts are also executed...