Dustin C. Hatch
0add34a9a3
One major problem with the current DNS-over-VPN implementation is that the ProtonVPN servers are prone to random outages. When the server we're using goes down, there is not a straightforward way to switch to another one. At first I tried creating a fake DNS zone with A records for each ProtonVPN server, all for the same name. This ultimately did not work, but I am not sure I understand why. strongSwan would correctly resolve the name each time it tried to connect, and send IKE initialization requests to a different address each time, but would reject the responses from all except the first address it used. The only way to get it working again was to restart the daemon. Since strongSwan is apparently not going to be able to handle this kind of fallback on its own, I decided to write a script to do it externally. Enter `protonvpn-watchdog.py`. This script reads the syslog messages from strongSwan (via the systemd journal, using `journalctl`'s JSON output) and reacts when it receives the "giving up after X tries" message. This message indicates that strongSwan has lost connection to the current server and has not been able to reestablish it within the retry period. When this happens, the script will consult the cached list of ProtonVPN servers and find the next one available. It keeps track of the ones that have failed in the past, and will not connect to them again, so as not to simply bounce back-and-forth between two (possibly dead) servers. Approximately every hour, it will attempt to refresh the server list, to ensure that the most accurate server scores and availability are known.
62 lines
1.5 KiB
YAML
62 lines
1.5 KiB
YAML
- name: ensure protonvpn ca certificate is installed
|
|
copy:
|
|
src: ProtonVPN_ike_root.pem
|
|
dest: /etc/strongswan/swanctl/x509ca/
|
|
mode: '0644'
|
|
notify: reload strongswan config
|
|
tags:
|
|
- strongswan-cacert
|
|
|
|
- name: ensure protonvpn configuration is set
|
|
template:
|
|
src: protonvpn.conf.j2
|
|
dest: /etc/strongswan/swanctl/conf.d/protonvpn.conf
|
|
mode: '0640'
|
|
notify: reload strongswan config
|
|
tags:
|
|
- strongswan-config
|
|
- protonvpn-config
|
|
- name: ensure protonvpn remote address is configured
|
|
copy:
|
|
dest: /etc/strongswan/swanctl/conf.d/protonvpn.remote_addrs
|
|
mode: '0640'
|
|
content: >
|
|
remote_addrs = {{ protonvpn_server }}
|
|
force: false
|
|
notify: reload strongswan config
|
|
tags:
|
|
- strongswan-config
|
|
- protonvpn-config
|
|
|
|
- name: ensure protonvpn-watchdog script is installed
|
|
copy:
|
|
src: protonvpn-watchdog.py
|
|
dest: /usr/local/bin/protonvpn-watchdog
|
|
mode: '0755'
|
|
notify: restart protonvpn-watchdog
|
|
tags:
|
|
- protonvpn-watchdog
|
|
- name: ensure protonvpn-watchdog systemd unit is installed
|
|
copy:
|
|
src: protonvpn-watchdog.service
|
|
dest: /etc/systemd/system/protonvpn-watchdog.service
|
|
mode: '0644'
|
|
notify:
|
|
- reload systemd
|
|
- restart protonvpn-watchdog
|
|
tags:
|
|
- protonvpn-watchdog
|
|
- systemd
|
|
- name: ensure protonvpn-watchdog service is enabled
|
|
service:
|
|
name: protonvpn-watchdog
|
|
enabled: true
|
|
tags:
|
|
- service
|
|
- name: ensure protonvpn-watchdog service is running
|
|
service:
|
|
name: protonvpn-watchdog
|
|
state: started
|
|
tags:
|
|
- service
|