OpenVPN Full Tunnel di Linux — easy-rsa, systemd, Cron Auto-Connect

# cekipsaya.com — install openvpn + tools pendukung
sudo apt update
sudo apt install openvpn openvpn-systemd-resolved -y

# Verify versi (harus 2.5+)
openvpn --version | head -1

# cekipsaya.com — install via dnf (Fedora 22+, RHEL 8+, Rocky/Alma)
sudo dnf install openvpn -y

# Untuk EPEL repo di RHEL/Rocky/Alma kalau package tidak ada di base:
sudo dnf install epel-release -y
sudo dnf install openvpn -y

openvpn --version | head -1

# cekipsaya.com — install via pacman
sudo pacman -S openvpn --noconfirm

# Optional: GUI integration via NetworkManager (kalau pakai DE)
sudo pacman -S networkmanager-openvpn --noconfirm

openvpn --version | head -1

# cekipsaya.com — copy file kantor.ovpn dari Downloads
# (atau dari channel yang aman dari admin)

sudo cp ~/Downloads/kantor.ovpn /etc/openvpn/client/kantor.conf

# Set permission ketat (file berisi private key!)
sudo chmod 600 /etc/openvpn/client/kantor.conf
sudo chown root:root /etc/openvpn/client/kantor.conf

# cekipsaya.com — wajib ada di config untuk full tunnel di Linux
client
dev tun
proto tcp
remote 103.10.x.x 1194

redirect-gateway def1

remote-cert-tls server
cipher AES-256-CBC
auth SHA256
auth-user-pass

# DNS handling untuk Ubuntu/Debian dengan systemd-resolved:
script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre

verb 3

# (CA + cert + key embed di bawah)
<ca>...</ca>
<cert>...</cert>
<key>...</key>

# cekipsaya.com — connect manual dengan output verbose
sudo openvpn --config /etc/openvpn/client/kantor.conf

# Output akan show handshake step real-time. Kalau muncul:
# "Initialization Sequence Completed" = SUCCESS
# Tekan Ctrl+C untuk disconnect.

# cekipsaya.com — buka terminal kedua sambil connection masih aktif

# Cek IP publik client
curl -s https://cekipsaya.com/api/?action=myip | grep -oE '"ip":"[^"]+'

# Cek default route (harus via tun0/utun)
ip route | grep default

# Cek DNS resolver (harus DNS push dari server)
resolvectl status | grep "Current DNS"

# Cek interface tun0 active
ip addr show tun0

#!/bin/bash
# cekipsaya.com — /usr/local/bin/openvpn-monitor.sh
# Auto-restart OpenVPN kalau ping ke gateway tunnel fail

TUNNEL_GW="192.168.77.1"   # gateway dalam tunnel (sisi server)
SERVICE="openvpn-client@kantor"
LOG="/var/log/openvpn-monitor.log"

if ping -c 3 -W 2 -I tun0 "$TUNNEL_GW" > /dev/null 2>&1; then
    # Tunnel sehat — log ringkas
    echo "$(date '+%Y-%m-%d %H:%M:%S') OK" >> "$LOG"
else
    # Tunnel down — restart service
    echo "$(date '+%Y-%m-%d %H:%M:%S') DOWN — restarting $SERVICE" >> "$LOG"
    systemctl restart "$SERVICE"
    sleep 10
    # Verify after restart
    if ping -c 3 -W 2 -I tun0 "$TUNNEL_GW" > /dev/null 2>&1; then
        echo "$(date '+%Y-%m-%d %H:%M:%S') RECOVERED" >> "$LOG"
    else
        echo "$(date '+%Y-%m-%d %H:%M:%S') RESTART FAILED" >> "$LOG"
    fi
fi

# cekipsaya.com — install + schedule monitoring
sudo mv openvpn-monitor.sh /usr/local/bin/
sudo chmod +x /usr/local/bin/openvpn-monitor.sh

# Edit root crontab
sudo crontab -e

# Tambah line ini (cek tiap 5 menit):
*/5 * * * * /usr/local/bin/openvpn-monitor.sh

# Verify cron aktif:
sudo crontab -l | grep openvpn

# cekipsaya.com — log systemd OpenVPN client
sudo journalctl -u openvpn-client@kantor -f

# Filter log 1 jam terakhir
sudo journalctl -u openvpn-client@kantor --since "1 hour ago"

# Cek log monitoring script
tail -50 /var/log/openvpn-monitor.log