From: Tom Rymes <trymes@rymes.com>
To: development@lists.ipfire.org
Subject: Re: [PATCH 1/2] ipsec: Add script to ensure VPNs are always on
Date: Thu, 06 Feb 2020 15:06:20 -0500 [thread overview]
Message-ID: <e80aa17c-d9ce-8325-1981-c52a6c143db3@rymes.com> (raw)
In-Reply-To: <5CECA878-928D-4859-9053-1F4DD59B15F0@ipfire.org>
[-- Attachment #1: Type: text/plain, Size: 1699 bytes --]
On 02/06/2020 10:03 AM, Michael Tremer wrote:
> Hi,
>
>> On 5 Feb 2020, at 17:36, Tom Rymes <trymes(a)rymes.com> wrote:
[snip]
>> Sorry for being unclear. There are currently eight options for "Inactivity Timeout", including "Unlimited". I would propose that the script you are adding should only bring back up tunnels whose Inactivity Timeout is set to "Unlimited". A tunnel with a timeout of one hour would time out, go down, and then the script should ignore it.
>
> The inactivity timeout is only active when the connection is in “on demand” mode. The script ignores connections in that mode, so nothing will happen here.
Right, but I had proposed to combine "Always On" and "On Demand" into
one, as they will effectively be the same after this proposed change.
After this change, unless I am missing something, the only difference
will be the "Inactivity Timeout".
If "On Demand" and "Always On" are combined into "Normal" (as opposed to
"Wait for connection initiation"), then the script can use the Inactivty
timeout to determine which tunnels to bring up. Come to think of it,
shouldn't the script also bring up any "On-Demand" tunnels that are set
to a timeout of "Unlimited"? I know that we run *all* of our tunnels as
"On-Demand/Unlimited" because auto=route is so much more reliable.
It's not really a big deal either way, but if the only difference
between "On Demand" and "Always On" after this proposed change is going
to be the inactivity timeout, then I'd say merge the two into one and
use the Inactivity Timeout of "Unlimited" to denote which tunnels should
always be up. It's cleaner and less confusing.
My $0.02.
Tom
prev parent reply other threads:[~2020-02-06 20:06 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-05 11:24 Michael Tremer
2020-02-05 11:24 ` [PATCH 2/2] ipsec: Silence charon Michael Tremer
2020-02-05 15:25 ` Tom Rymes
2020-02-05 16:55 ` Michael Tremer
2020-02-05 17:16 ` Tom Rymes
2020-02-05 15:23 ` [PATCH 1/2] ipsec: Add script to ensure VPNs are always on Tom Rymes
2020-02-05 16:53 ` Michael Tremer
2020-02-05 17:19 ` Tom Rymes
2020-02-05 17:22 ` Michael Tremer
2020-02-05 17:36 ` Tom Rymes
2020-02-06 15:03 ` Michael Tremer
2020-02-06 20:06 ` Tom Rymes [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e80aa17c-d9ce-8325-1981-c52a6c143db3@rymes.com \
--to=trymes@rymes.com \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox