How can I permanently associate tc qdisc commands with a particular interface?

Question

I need to use a tc qdisc command to limit bandwidth usage on an interface created by openvpn. This works great when I run the command manually but occasionally the connection drops or restarts and this appears to cancel or deactivate the previously applied bandwidth settings. Is there a way to make a tc qdisc command apply permanently (or at least until I choose to cancel it) on a particular interface in such a way that any time that interface is up, my bandwidth settings will apply? I need something like the firewall-cmd permanent flag that makes the settings stick.

The command I'm currently using looks something like this:

tc qdisc add dev tun0 tbf rate 1mbit latency...

where tun0 is the interface name created by openvpn.

Answer 1

openvpn has an option called --up cmd which runs cmd whenever the VPN connection is first established, and an --up-restart option which tells openvpn to also run the --up command when a connection is restarted.

You can write a script which contains your tc qdisc ... command, make it executable with chmod +x, and then add --up /path/to/my/script --up-restart to the openvpn command line.

Alternatively, the cmd can be a properly quoted string containing the entire command and all its arguments. e.g.

openvpn ...  --up 'tc qdisc ...' --up-restart ...

This is possibly simpler, but a script is more flexible and makes it easier to do more than one thing when the connection is established.

BTW, there is also a --down cmd option which is used to run scripts or other programs whenever a VPN disconnects.

See man openvpn for more details about --up and --down and related options.

---

Note: it is possible that your Linux distribution may already make use of this feature, and may have a directory where you can just create a script to have it automatically run whenever the VPN is first established or restarted. Check the documentation for your distribution's openvpn package. If it does something like that, then follow the instructions there. If not, use the --up option as mentioned above.