{"action":"created","issue":{"url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/272","labels_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/272/labels{/name}","comments_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/272/comments","events_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/272/events","html_url":"https://github.com/freifunk-berlin/firmware/issues/272","id":104235547,"number":272,"title":"use ifup/down events to start openvpn","user":{"login":"booo","id":424513,"avatar_url":"https://avatars.githubusercontent.com/u/424513?v=3","gravatar_id":"","url":"https://api.github.com/users/booo","html_url":"https://github.com/booo","followers_url":"https://api.github.com/users/booo/followers","following_url":"https://api.github.com/users/booo/following{/other_user}","gists_url":"https://api.github.com/users/booo/gists{/gist_id}","starred_url":"https://api.github.com/users/booo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/booo/subscriptions","organizations_url":"https://api.github.com/users/booo/orgs","repos_url":"https://api.github.com/users/booo/repos","events_url":"https://api.github.com/users/booo/events{/privacy}","received_events_url":"https://api.github.com/users/booo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/freifunk-berlin/firmware/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-09-01T10:23:26Z","updated_at":"2015-10-09T10:34:32Z","closed_at":null,"body":"At the moment openvpn starts on system boot. It starts even if we do not have a connection on the WAN port (to the internet). In the worst case openvpn traffic gets routed through the mesh (through other openvpn tunnels). In one of three cases this can happen because the firewall configuration for openvpn/vpn03 misses one of the server ips [1].\r\n\r\nWe should start openvpn on wan ifup events and make sure there is a default route via the wan interface. If the interface goes down we should stop openvpn. Once we have this script we can remove the old firewall rules.\r\n\r\n[1] https://github.com/freifunk-berlin/firmware-packages/blob/master/utils/freifunk-berlin-openvpn-files/uci-defaults/freifunk-berlin-openvpn#L38"},"comment":{"url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/comments/146829969","html_url":"https://github.com/freifunk-berlin/firmware/issues/272#issuecomment-146829969","issue_url":"https://api.github.com/repos/freifunk-berlin/firmware/issues/272","id":146829969,"user":{"login":"sarumpaet","id":10619084,"avatar_url":"https://avatars.githubusercontent.com/u/10619084?v=3","gravatar_id":"","url":"https://api.github.com/users/sarumpaet","html_url":"https://github.com/sarumpaet","followers_url":"https://api.github.com/users/sarumpaet/followers","following_url":"https://api.github.com/users/sarumpaet/following{/other_user}","gists_url":"https://api.github.com/users/sarumpaet/gists{/gist_id}","starred_url":"https://api.github.com/users/sarumpaet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sarumpaet/subscriptions","organizations_url":"https://api.github.com/users/sarumpaet/orgs","repos_url":"https://api.github.com/users/sarumpaet/repos","events_url":"https://api.github.com/users/sarumpaet/events{/privacy}","received_events_url":"https://api.github.com/users/sarumpaet/received_events","type":"User","site_admin":false},"created_at":"2015-10-09T10:34:32Z","updated_at":"2015-10-09T10:34:32Z","body":"@cholin Was there anything wrong with https://github.com/freifunk-berlin/firmware-packages/commit/1a7c71ff3e132ed77ddc271d7b625b8acfde8b59 ? Otherwise the openvpn-hotplug branch should not require iptables anymore. :)"}}