--up cmd
Run command cmd after successful TUN/TAP device open (pre --user
UID change).
cmd consists of a path to script (or executable program),
optionally followed by arguments. The path and arguments may be
single- or double-quoted and/or escaped using a backslash, and
should be separated by one or more spaces.
The up command is useful for specifying route commands which
route IP traffic destined for private subnets which exist at the
other end of the VPN connection into the tunnel.
For --dev tun execute as:
cmd tun_dev tun_mtu link_mtu ifconfig_local_ip ifcon-
fig_remote_ip [ init | restart ]
For --dev tap execute as:
cmd tap_dev tap_mtu link_mtu ifconfig_local_ip ifconfig_netmask
[ init | restart ]
See the "Environmental Variables" section below for additional
parameters passed as environmental variables.
Note that if cmd includes arguments, all OpenVPN-generated argu-
ments will be appended to them to build an argument list with
which the executable will be called.
Typically, cmd will run a script to add routes to the tunnel.
Normally the up script is called after the TUN/TAP device is
opened. In this context, the last command line parameter passed
to the script will be init. If the --up-restart option is also
used, the up script will be called for restarts as well. A
restart is considered to be a partial reinitialization of Open-
VPN where the TUN/TAP instance is preserved (the --persist-tun
option will enable such preservation). A restart can be gener-
ated by a SIGUSR1 signal, a --ping-restart timeout, or a connec-
tion reset when the TCP protocol is enabled with the --proto
option. If a restart occurs, and --up-restart has been speci-
fied, the up script will be called with restart as the last
parameter.
The following standalone example shows how the --up script can
be called in both an initialization and restart context. (NOTE:
for security reasons, don't run the following example unless UDP
port 9999 is blocked by your firewall. Also, the example will
run indefinitely, so you should abort with control-c).
openvpn --dev tun --port 9999 --verb 4 --ping-restart 10 --up
'echo up' --down 'echo down' --persist-tun --up-restart
Note that OpenVPN also provides the --ifconfig option to auto-
matically ifconfig the TUN device, eliminating the need to
define an --up script, unless you also want to configure routes
in the --up script.
If --ifconfig is also specified, OpenVPN will pass the ifconfig
local and remote endpoints on the command line to the --up
script so that they can be used to configure routes such as:
route add -net 10.0.0.0 netmask 255.255.255.0 gw $5
