OpenVPN Client Export

[VirtualSamuraii]

Hi there, thank you for your amazing work with this API.

As i'm trying to automate the process of creating individual access to a VPN server, I have developed a PHP script that creates a user certificate using the API endpoints System > Certificates.

Is there any available endpoint allowing me to export the vpn client config using this certificate ?

[mrizkihidayat66]

usr\local\pkg\RESTAPI\Endpoints\VPNOpenVPNExportsEndpoint.inc

<?php

namespace RESTAPI\Endpoints;

require_once 'RESTAPI/autoloader.inc';

use RESTAPI\Core\Endpoint;

/**
 * Defines an Endpoint for interacting with a single OpenVPNExport Model object at
 * /api/v2/vpn/openvpn/exports.
 */
class VPNOpenVPNExportsEndpoint extends Endpoint {
    public function __construct() {
        # Set Endpoint attributes
        $this->url = '/api/v2/vpn/openvpn/exports';
        $this->model_name = 'OpenVPNExport';
        $this->request_method_options = ['GET'];
        $this->many = true;

        # Construct the parent Endpoint object
        parent::__construct();
    }
}

usr\local\pkg\RESTAPI\Endpoints\VPNOpenVPNExportEndpoint.inc

<?php

namespace RESTAPI\Endpoints;

require_once 'RESTAPI/autoloader.inc';

use RESTAPI\Core\Endpoint;

/**
 * Defines an Endpoint for interacting with a single OpenVPNExport Model object at
 * /api/v2/vpn/openvpn/export.
 */
class VPNOpenVPNExportEndpoint extends Endpoint {
    public function __construct() {
        # Set Endpoint attributes
        $this->url = '/api/v2/vpn/openvpn/export';
        $this->model_name = 'OpenVPNExport';
        $this->request_method_options = ['GET', 'PATCH'];

        # Construct the parent Endpoint object
        parent::__construct();
    }
}

usr\local\pkg\RESTAPI\Models\OpenVPNExport.inc

<?php

namespace RESTAPI\Models;

use RESTAPI\Core\Model;
use RESTAPI\Fields\BooleanField;
use RESTAPI\Fields\ForeignModelField;
use RESTAPI\Fields\IntegerField;
use RESTAPI\Fields\PortField;
use RESTAPI\Fields\ObjectField;
use RESTAPI\Fields\StringField;
use RESTAPI\Responses\ConflictError;
use RESTAPI\Responses\ValidationError;
use RESTAPI\Validators\HostnameValidator;
use RESTAPI\Validators\IPAddressValidator;

/**
 * Defines a Model that represents OpenVPN Export.
 */
class OpenVPNExport extends Model {
    const DMYPWD = "********";

    //public ForeignModelField $server;
    public IntegerField $server;
    public StringField $useaddr;
    public StringField $useaddr_hostname;
    public StringField $verifyservercn;
    public BooleanField $blockoutsidedns;
    public BooleanField $legacy;
    public BooleanField $silent;
    public StringField $bindmode;
    # SKIP: public BooleanField $usepkcs11;
    public BooleanField $usetoken;
    public BooleanField $usepass;
    public StringField $pass;
    public StringField $p12encryption;
    public BooleanField $useproxy;
    public StringField $useproxytype;
    public StringField $proxyaddr;
    public PortField $proxyport;
    public StringField $useproxypass;
    public StringField $proxyuser;
    public StringField $proxypass;
    public StringField $advancedoptions;
    public ObjectField $users;

    public function __construct(mixed $id = null, mixed $parent_id = null, mixed $data = [], mixed ...$options) {
        # Set model attributes
        $this->config_path = 'installedpackages/vpn_openvpn_export/serverconfig/item';
        $this->packages = ['pfSense-pkg-openvpn-client-export'];
        $this->package_includes = ['openvpn-client-export.inc'];
        $this->always_apply = true;
        $this->many = true;

        # Set model fields
        //$this->server = new ForeignModelField(
        //    model_name: 'OpenVPNServer',
        //    model_field: 'vpnid',
        //    default: null,
        //    allow_empty: true,
        //    allow_null: true,
        //    many: true,
        //    help_text: 'The VPN ID of the OpenVPN server this client export corresponds to.',
        //);
        $this->server = new IntegerField(
            unique: true,
            default_callable: 'get_next_vpn_id',
            editable: true,
            read_only: false,
            help_text: 'The unique ID for this OpenVPN server. This value is assigned by the ' .
                'system and cannot be changed.',
        );

        # Client Connection Behavior
        $this->useaddr = new StringField(
            required: true,
            choices: ['serveraddr', 'servermagic', 'servermagichost', 'serverhostname', 'other'],
            help_text: 'Host Name Resolution'
        );
        $this->useaddr_hostname = new StringField(
            required: true,
            allow_empty: false,
            conditions: ['useaddr' => 'other'],
            validators: [new HostnameValidator(allow_hostname: true, allow_domain: true, allow_fqdn: true)],
            help_text: 'Host Name'
        );
        $this->verifyservercn = new StringField(
            default: 'auto',
            choices: ['auto', 'none'],
            help_text: 'Verify Server CN'
        );
        $this->blockoutsidedns = new BooleanField(
            default: false,
            indicates_true: 'yes',
            indicates_false: '',
            help_text: 'Block Outside DNS'
        );
        $this->legacy = new BooleanField(
            default: false,
            indicates_true: 'yes',
            indicates_false: '',
            help_text: 'Legacy Client'
        );
        $this->silent = new BooleanField(
            default: false,
            indicates_true: 'yes',
            indicates_false: '',
            help_text: 'Silent Installer'
        );
        $this->bindmode = new StringField(
            default: 'nobind',
            choices: ['nobind', 'lport0', 'bind'],
            help_text: 'Bind Mode'
        );

        # Certificate Export Options
        $this->usetoken = new BooleanField(
            default: false,
            indicates_true: 'yes',
            indicates_false: '',
            help_text: 'Microsoft Certificate Storage'
        );
        $this->usepass = new BooleanField(
            default: false,
            indicates_true: 'yes',
            indicates_false: '',
            help_text: 'Password Protect Certificate'
        );
        $this->pass = new StringField(
            required: true,
            default: null,
            conditions: ['usepass' => true],
            help_text: 'Certificate Password'
        );
        $this->p12encryption = new StringField(
            default: 'high',
            choices: ['high', 'low', 'legacy'],
            help_text: 'PKCS#12 Encryption'
        );

        # Proxy Options
        $this->useproxy = new BooleanField(
            default: false,
            indicates_true: 'yes',
            indicates_false: '',
            help_text: 'Use A Proxy'
        );
        $this->useproxytype = new StringField(
            default: 'http',
            choices: ['http', 'socks'],
            conditions: ['useproxy' => true],
            help_text: 'Proxy Type'
        );
        $this->proxyaddr = new StringField(
            required: true,
            allow_empty: false,
            default: null,
            validators: [new IPAddressValidator(allow_ipv4: true, allow_ipv6: false)],
            conditions: ['useproxy' => true],
            help_text: 'Proxy IP Address',
        );
        $this->proxyport = new PortField(
            required: true,
            unique: true,
            default: null,
            allow_alias: false,
            allow_range: false,
            conditions: ['useproxy' => true],
            help_text: 'Proxy Port',
        );
        $this->useproxypass = new StringField(
            required: true,
            default: null,
            choices: ['none', 'basic', 'ntlm'],
            conditions: ['useproxy' => true],
            help_text: 'Proxy Authentication'
        );
        $this->proxyuser = new StringField(
            required: true,
            default: null,
            conditions: ['useproxy' => true, 'useproxypass' => ['basic', 'ntlm']],
            help_text: 'Proxy Username'
        );
        $this->proxypass = new StringField(
            required: true,
            conditions: ['useproxy' => true, 'useproxypass' => ['basic', 'ntlm']],
            help_text: 'Proxy Password'
        );

        # Advanced
        $this->advancedoptions = new StringField(
            default: [],
            allow_empty: true,
            many: true,
            delimiter: ';',
            help_text: 'Additional options to add to the OpenVPN client export configuration.',
        );

        # OpenVPN Clients
        $this->users = new ObjectField(
            default_callable: 'get_user_certificate',
            allow_empty: true,
            many: true,
            many_minimum: 0,
            help_text: '',
        );

        parent::__construct($id, $parent_id, $data, ...$options);
    }

    /**
     * Obtains the next available VPN ID.
     * @return integer The next available ID number.
     */
    public function get_next_vpn_id(): int {
        return openvpn_vpnid_next();
    }

    /**
     * 
     */
    public function get_user_certificate(): array {
        $users = [];
        foreach (User::read_all()->model_objects as $user) {
            $users[] = $user;
        }
        return $users;
    }

    /**
     * Applies changes to this OpenVPN Server.
     */
    public function apply(): void {
        
    }
}

Hi @jaredhendrickson13 can you help me with this case, I'm trying to create this endpoint but not works with 404 Not Found error :'(

[jaredhendrickson13]

@mrizkihidayat66 once you have the endpoint class written to /usr/local/pkg/RESTAPI/Endpoints/ you'll need to run pfsense-restapi buildendponts to generate the endpoint in the pfSense web root.

You may find these resources useful for building out models and endpoints as well:

https://pfrest.org/BUILDING_CUSTOM_MODEL_CLASSES/

https://pfrest.org/BUILDING_CUSTOM_ENDPOINT_CLASSES/

[mrizkihidayat66]

@jaredhendrickson13 Hi, thank you. I can now make the API respond, but I still can't get it to return what I expect. Can you help me? I want to be able to download an OpenVPN client configuration file from the API.

[Ceald1]

Any updates on this? I also can't figure out how to export the ovpn file from the API?

[cvanbrummelen]

Would love to have this added aswell.

[CyberHippo]

That would be a great feature!

[cvanbrummelen]

Any luck on getting it to work @mrizkihidayat66 ?

[jaredhendrickson13]

The majority of the work for this feature is done and currently in next_minor. Still needs additional tests written and some quirkiness with some of the required pfSense functions to be fully ironed out. Assuming all that goes well, it should be included in v2.6.0.

[cvanbrummelen]

Greate news!

[jaredhendrickson13]

Dev build v2.6.0-dev-772a828 has this feature implemented and tested for anyone looking to test their own implementations early or get any last minute bugs worked out.

A stable v2.6.0 release likely won't be until shortly after pfSense CE 2.8.1 and pfSense Plus 25.07 are released, so still likely a couple weeks out at least.