Post processing of routes and DNS

[pschichtel]

What I'm requesting is basically https://github.com/adrienverge/openfortivpn/wiki#using-pppd-ip-up--ip-down-scripts, buth without the need for --no-dns and --no-routes.

The VPN I need to connect to has a log of routes and search domains, however there is exist a few problems with that configuration that can't easily be solved on the VPN server side. So instead I want to "post process" the routes and search domains I receive from the VPN. Add additional routes, remove routes, add additional search domains, remove search domains.

Currently I'd need to duplicate all routes and search domains before being able to add my own.

[DimitriPapadopoulos]

That would typically be solved by outsourcing routing/DNS setting to an external script, typically the vpnc-script used by OpenConnect.

[pschichtel]

I don't think I follow

[DimitriPapadopoulos]

Perhaps I'm not following either. You need custom routing/DNS settings. This would be easy to achieve with an external script, called by openfortivpn, typically with a --script option, and setting routing/DNS instead of openfortivpn. As documented in #678, I believe this is the best solution to implement this request and other similar requests, such as #371, of which I believe this issue is a duplicate.

Have you tried following these instructions without --no-dns and --no-routes?
https://github.com/adrienverge/openfortivpn/wiki#using-pppd-ip-up--ip-down-scripts

[pschichtel]

My point is: I explicitly don't want --no-dns and --no-routes. Want to take what the VPN server provides me, but just customize it a little.

The problem with the pppd script is that they are executed before openfortivpn sets the routes and domains, so the script can't change anything about the values.

[DimitriPapadopoulos]

Then I believe the best solution would be to implement the above functionality, where openfortivpn calls an external script to set routing and DNS.

[pschichtel]

Yes I think that would be the most straight forward solution. Similar to wireguard'a PostUp option or the existing pppd scripts (just executed later).

[DimitriPapadopoulos]

Do we agree this is a duplicate of #678? If so, can I close this issue?

[pschichtel]

I guess whatever useful solution comes out of #678 would be able to cover this.