tutorial

Uptime monitoring for OpenVPN

OpenVPN is the most widely deployed open-source VPN solution. It secures remote access for distributed teams, connects branch offices, and protects traffic o...

OpenVPN is the most widely deployed open-source VPN solution. It secures remote access for distributed teams, connects branch offices, and protects traffic on untrusted networks. When OpenVPN goes down, remote workers lose access to internal systems and branch offices lose connectivity — and the failure is often invisible until someone calls IT asking why "the VPN is broken."

This tutorial covers production-grade uptime monitoring for OpenVPN using Vigilmon. We will walk through:

  • Monitoring the OpenVPN UDP port 1194 and management interface TCP port 7505
  • Monitoring the OpenVPN Access Server web UI /health endpoint
  • SSL certificate alerts for the VPN server certificate
  • Heartbeat monitoring for connection stability checks

Prerequisites

  • OpenVPN 2.5+ running on Linux (community edition or Access Server)
  • Access to the OpenVPN management interface (enabled via config)
  • A free account at vigilmon.online

Part 1: Enable the OpenVPN management interface

The OpenVPN management interface exposes a TCP socket that provides real-time status, client list, and control commands. Enable it by adding to your server configuration:

# /etc/openvpn/server/server.conf

# Enable management interface on localhost port 7505
management 127.0.0.1 7505

# Require a password for management access
management-client-auth

# Core server config
port 1194
proto udp
dev tun
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/server.crt
key /etc/openvpn/pki/private/server.key
dh /etc/openvpn/pki/dh.pem

Restart OpenVPN after changing the config:

systemctl restart openvpn-server@server

Verify the management interface is listening:

ss -tlnp | grep 7505

Expected output:

LISTEN  0  128  127.0.0.1:7505  0.0.0.0:*  users:(("openvpn",pid=1234,fd=7))

Test connectivity to the management interface:

echo "status" | nc 127.0.0.1 7505

Expected output (partial):

OpenVPN CLIENT LIST
Updated,2026-07-12 10:00:00
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ROUTING TABLE
...
END

Part 2: Expose a health endpoint via a local proxy

The OpenVPN management interface listens on localhost and speaks a line-protocol (not HTTP). To let Vigilmon poll it, create a small health endpoint script that checks management connectivity and exposes it over HTTP:

#!/usr/bin/env bash
# /usr/local/bin/openvpn-health.sh
# Run with a simple HTTP wrapper like socat or python3

STATUS=$(echo "status" | nc -w 2 127.0.0.1 7505 2>/dev/null)
if echo "$STATUS" | grep -q "OpenVPN CLIENT LIST"; then
  echo "HTTP/1.1 200 OK"
  echo "Content-Type: text/plain"
  echo ""
  echo "ok"
else
  echo "HTTP/1.1 503 Service Unavailable"
  echo "Content-Type: text/plain"
  echo ""
  echo "management interface unreachable"
fi

Serve it with socat:

# /etc/systemd/system/openvpn-health.service
[Unit]
Description=OpenVPN health check HTTP endpoint
After=network.target openvpn-server@server.service

[Service]
Type=simple
ExecStart=/usr/bin/socat TCP-LISTEN:8194,reuseaddr,fork EXEC:/usr/local/bin/openvpn-health.sh
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start:

systemctl daemon-reload
systemctl enable --now openvpn-health

Now curl http://localhost:8194/ returns ok when the management interface is reachable. Expose this port on a firewall rule scoped to Vigilmon's monitoring IPs.

Part 3: Monitor with Vigilmon

TCP check on port 7505 (via SSH tunnel or exposed endpoint)

For the management interface TCP port, if your host is directly reachable:

  1. Log in to vigilmon.online and click Add Monitor.
  2. Choose TCP monitor.
  3. Enter host: vpn.example.com, port: 7505.
  4. Set interval to 1 minute.
  5. Add your alert channel.
  6. Click Save.

This confirms the management interface process is running and accepting connections.

HTTP check on the health endpoint

  1. Click Add Monitor → HTTP(S) monitor.
  2. Enter: http://vpn.example.com:8194/
  3. Set interval to 1 minute.
  4. Add a keyword check: must contain ok.
  5. Add your alert channel.
  6. Click Save.

This confirms OpenVPN is running AND the management interface is responding to status queries.

Part 4: Monitor OpenVPN Access Server (if using AS)

OpenVPN Access Server includes a dedicated /health endpoint on its web UI:

curl -k https://vpn.example.com:943/health

Expected response:

{"status": "ok"}

Add a Vigilmon HTTP monitor for it:

  1. Click Add Monitor → HTTP(S) monitor.
  2. Enter: https://vpn.example.com:943/health
  3. Set interval to 1 minute.
  4. Add a keyword check: must contain "status": "ok".
  5. Add your alert channel.
  6. Click Save.

Also monitor the Access Server web UI itself (the admin dashboard) as a separate check:

  1. Click Add Monitor → HTTP(S) monitor.
  2. Enter: https://vpn.example.com:943/
  3. Set interval to 5 minutes.
  4. Set expected status code to 200 or 302.
  5. Add your alert channel.
  6. Click Save.

Part 5: Heartbeat monitoring for connection stability checks

Many VPN operations teams run periodic scripts that verify tunnel connectivity end-to-end: ping a host through the VPN, check that split tunneling is working correctly, or verify that DNS is resolving over the tunnel. These should send heartbeats to Vigilmon so you know they ran.

Create the heartbeat monitor

  1. In Vigilmon, click Add Monitor → Heartbeat monitor.
  2. Name it: OpenVPN tunnel stability check.
  3. Set the expected interval to 5 minutes.
  4. Set grace period to 2 minutes.
  5. Copy the heartbeat URL.
  6. Click Save.

Send the heartbeat from your stability check script

#!/usr/bin/env bash
# /usr/local/bin/openvpn-stability-check.sh
# Run from a host with an active VPN tunnel

set -euo pipefail

INTERNAL_HOST="192.168.100.1"   # A host only reachable via VPN
HEARTBEAT_URL="https://vigilmon.online/api/heartbeat/YOUR_TOKEN"

# Verify tunnel connectivity
if ping -c 3 -W 5 "$INTERNAL_HOST" > /dev/null 2>&1; then
  echo "[$(date)] VPN tunnel OK — $INTERNAL_HOST reachable"
  curl -fsS --retry 3 "$HEARTBEAT_URL" > /dev/null
else
  echo "[$(date)] ERROR: VPN tunnel down — $INTERNAL_HOST not reachable" >&2
  exit 1
fi

Schedule it with cron:

# /etc/cron.d/openvpn-stability
*/5 * * * * root /usr/local/bin/openvpn-stability-check.sh >> /var/log/openvpn-stability.log 2>&1

If the tunnel check fails, the script exits before the heartbeat ping, and Vigilmon alerts you within one interval.

Part 6: SSL certificate monitoring

VPN server certificates are often long-lived and manually renewed, making them prone to being forgotten until they expire. Add an SSL monitor to get alerted well in advance:

  1. In Vigilmon, click Add Monitor → SSL monitor.
  2. Enter your VPN server's hostname: vpn.example.com.
  3. Set alert threshold to 14 days before expiry.
  4. Add your alert channel.
  5. Click Save.

Check the VPN certificate expiry manually at any time:

openssl s_client -connect vpn.example.com:443 -showcerts </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

Or for the raw TLS port used by OpenVPN:

openssl s_client -connect vpn.example.com:1194 </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

For OpenVPN Access Server, also check the admin UI cert:

openssl s_client -connect vpn.example.com:943 </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

Add a separate Vigilmon SSL monitor for each domain/port combination you need to track.

Part 7: Alert on management interface events via webhook

Vigilmon can call your webhook when any monitor goes DOWN or recovers UP. This lets you trigger automated responses — restart OpenVPN, page on-call, or post to Slack:

// Example webhook receiver
import express from 'express';
import { execSync } from 'child_process';

const app = express();
app.use(express.json());

app.post('/webhook/vigilmon', (req, res) => {
  const { monitor_name, status, checked_at } = req.body;

  if (status === 'down' && monitor_name.includes('OpenVPN')) {
    console.error('[VIGILMON] OpenVPN DOWN at', checked_at);

    // Attempt automatic restart (only if you trust this automation)
    try {
      execSync('systemctl restart openvpn-server@server', { timeout: 30000 });
      console.log('[VIGILMON] Restarted openvpn-server@server');
    } catch (err) {
      console.error('[VIGILMON] Restart failed:', err.message);
    }
  }

  res.sendStatus(204);
});

app.listen(3000);

Configure the webhook in Vigilmon under Settings → Notification Channels → Webhook.

Summary

Your OpenVPN deployment now has five layers of monitoring:

  1. TCP port 7505 check — confirms the management interface process is running.
  2. HTTP health endpoint — confirms the management interface responds to status queries and OpenVPN is processing them.
  3. Access Server /health endpoint — for AS deployments, confirms the Access Server web service is healthy.
  4. Heartbeat monitor — your tunnel stability script pings Vigilmon every 5 minutes; missing pings trigger alerts.
  5. SSL certificate monitor — alerts 14 days before the VPN server certificate expires.

Vigilmon handles check scheduling, multi-region polling, alert routing, and uptime history. You get notified within 60 seconds of any failure in the VPN stack.

Monitor your OpenVPN infrastructure free at vigilmon.online

#openvpn #vpn #networking #monitoring #devops #security

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles