I am using raspbian. (Debian variant).

By default, openvpn is started with /etc/rc2.d/S03openvpn. I set up an /etc/init.d script with a symlink /etc/rc2.d/S04daemonname for a daemon I want to start after openvpn has started and a connection to my vpn provider has been established. The openvpn startup and connection works fine. However my daemon that I want to use the vpn connection seems to start up before the connection is established, since it uses my standard ip. If I kill the daemon and restart it in the terminal, it is then using the desired vpn ip.

How would I make it so my daemon runs at startup once the vpn connection is established? Can I do this by waiting until tun0 device has been created (how?), or is the tun0 creation not synonymous with established connection meaning this might be too early? I've also looked into using the run time dependencies LSB tags in the init.d script, but can't find how to make a certain network device (tun0) a requirement and again, I'm unsure whether this would work. There is also a file in /etc/NetworkManager/VPN/ referencing the openvpn service, but I'm not sure how to use this or if the NetworkManager daemon is even being used because /VPN is the only subdirectory of it.

I would like solutions that are precise, eg. not just putting my init.d script with a low enough run priority in /etc/rc2.d/ or waiting until the openvpn connection should be established.

2 Answers 2


You can run scripts from openvpn with e.g. the --up scriptname option.

This would seem to me to be better than expecting the connection to be established a certain time after starting the openvpn process. You may have to experiment a bit with the possible ways of running scripts from openvpn, e.g. not using --up but instead using --client-connect etc.; check the openvpn manpage for more information.


Consider setting ip_nonlocal_bind. It is the answer from this related question - https://serverfault.com/questions/474997/how-can-a-larger-delay-be-placed-between-two-interdependent-upstart-or-etc-init/475013#475013. Google it - here is one link - https://sebest.github.io/post/linux-how-to-bind-ip-that-doesn-t-exist-yet/

I have to admit I haven't tested it as I as not so experienced.

It seems to me you're trying to bind postgres to an IP associated with the tunnel. If that's the case, the ip_nonlocal_bind is the solution to your problems. Setting the ip_nonlocal_bind allows you to bind to any IP, even one not associated with your computer, which is exactly what you want when you want to bind to an IP you don't yet have - for instance when using virtual IP's that floats between active and passive nodes.

Assuming this is ipv4 only;

echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind

Or throw it into /etc/sysctl.conf


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .