Luci app openvpn plus by masmbit · Pull Request #9126 · openwrt/luci

masmbit · 2026-10-10T22:21:43Z

Pull request details

Description

This PR adds luci-app-openvpn-plus. It is a modern and easy web interface to set up OpenVPN servers and clients quickly.

The app does all the hard background work automatically so users do not need to write complex config files.

Key features include:

Multi-Site-to-Site (Hub-and-Spoke): Easy setup for multiple router-to-router connections at the same time, fully automated with profile import and export.
Roadwarrior & Travel SSL-VPN: Simple step-by-step setup for mobile phones and laptops over TCP 443 with an instant secure QR-code scan for smartphones.
Smart Firewall & Routing: Automatically creates all needed firewall zones, traffic rules, and port forwardings with built-in protection against routing loops.
Easy Installation & Troubleshooting: Includes a live port checker and Double-NAT detection to help install the VPN easily behind strict internet provider modems.
Built-in DDNS & Key Generator: Automatically builds RSA-2048/ECC-Prime256 keys and static server keys into one file. It also includes an easy web-based key editor and DDNS support (DuckDNS, IPv64, dynv6, etc.).
Clear Status Table: Shows a nice overview of running tunnels, active process IDs (PIDs), and live data transfer.

Real-world speed tests on cheap hardware (Zyxel NWA50AX Pro APs) reached more than 450 Mbps in UDP Site-to-Site mode (using DCO) and over 200 Mbps in TCP/SSL-VPN mode.

Screenshot

Server Example with two Site-To-Site and one Mobile connection

Dark Mode Full supported

Status view

Client Example

Wizard

Mobile Setup

IP Setup Option

DDNS Setup Option

Profile QR-Code scan or download

Muti Site-To-Site Setup Wizard

Open Port and Static Routing view

KeyGen

Key view / edit

config view, firewall ...

Maintainer

@masmbit

Tested on

OpenWrt version: OpenWrt 25.12.5 (r33051-f5dae5ece4)
LuCI version: LuCI openwrt-25.12 branch (26.183.16146~6aacb73)
Web browser(s): Chrome, Firefox, Safari

Checklist

Includes what it depends on: This app relies on native packages (+openvpn-openssl +openssl-util +firewall4 +uclient-fetch) which are standard inside the OpenWrt feeds.

This package provides an all-in-one web interface to configure OpenVPN servers and clients quickly. It includes a setup wizard, a built-in key generator, smart firewall protection, port and route checks, DDNS, SSL-VPN, and QR-code import/export. With this app, the VPN setup is very simple and intuitive. Signed-off-by: Manfred Jaider <info@masmbit.com>

BKPepe

The wizard and dashboard are useful additions, but I’m not convinced the current implementation should introduce so much custom service, firewall and configuration management logic.

Why does this need to duplicate functionality already provided by OpenWrt instead of building on the existing OpenVPN integration? A separate LuCI app makes sense for the UI and higher-level workflows, but it should reuse the existing infrastructure wherever possible.

More importantly, the current patch has serious security issues around RPC permissions, shell command injection, private-key exposure and file permissions. These need to be addressed before this can be considered for inclusion.

masmbit · 2026-10-11T09:30:33Z

Yes, I need to change that: "Smart Firewall" is the wrong name and leads to misunderstandings that an additional firewall is running here. I will rename it to "OpenVPN Firewall Filters or something similar".

It is not an additional firewall, but rather specific filters exclusively for OpenVPN that utilize the firewall4 (fw4) tables. These filters only make sense in combination with OpenVPN. They were created to intercept massive bot attacks and scans, thereby relieving the OpenVPN process and preventing flooding.

Otherwise, I have tried as much as possible to avoid developing anything extra or parallel, focusing instead on using OpenWrt's built-in tools.

Furthermore, care was taken to minimize extra dependencies and avoid creating anything redundant (everything is programmed to fully suffice with BusyBox and uci).

The only unavoidable dependencies are:
+openvpn-openssl +openssl-util +firewall4 +uclient-fetch
(where +uclient-fetch is already included in standard OpenWrt).

I am currently analyzing and correcting the issues mentioned above. :D

masmbit · 2026-10-12T02:32:08Z

Hi there! I truly appreciate your time and helpful guidance on this PR.

To keep the application as clean and lightweight as possible, I have strictly avoided adding duplicate code or redundant modules. The entire package is fully designed to build directly on top of OpenWrt's existing infrastructure, utilizing built-in system tools like BusyBox and UCI wherever possible to minimize extra dependencies.

Following the review, I have updated the code to implement all requested security and structural improvements:

File Permissions & Storage: All certificates, keys, and profiles are now strictly created with secure 0600 permissions (0700 for folders) right at creation.
Central Sandbox Guard: I added a strict path-validation filter (securepath) to safely lock and sandbox all file operations inside the backend script.
Hardened ACLs: All raw file paths have been completely removed from the JSON ACL definitions to maximize system security.
Clean Installation: The intrusive uci-defaults script has been fully removed. The UI now safely warns the user if factory default configuration samples are detected, guiding them gently to the Wizard.
Feature Rename: Smart Firewall renamed to "Flood Guard" to clearly present it as an optional port-hardening extension that gracefully builds on top of fw4.

Everything has been fully cleaned up, tested, and is ready to go! Thank you for helping me make this application better and safer for the community.

…cles This update completely resolves security concerns regarding private-key exposure, shell command injection, RPC ACL permissions, and file leaks. - Fix ACL data exposure: Removed readfile and restricted readstatus paths. - Fix write race condition: Added inline umask 077 constraints. - Fix worker lifecycle: Decoupled tasks into sub-functions with shift. - Safe PID cleanup: Added traps and explicit rm endpoints for PID files. - Checked script against ShellCheck v0.11.0 rules. Signed-off-by: Manfred Jaider <info@masmbit.com>

openwrt-ai

Commit checks

fa1eccb "luci-app-openvpn-plus: fix security vulnerabilities and worker lifecycles": this commit is still a fix-up of the package that e032a2c adds in this same PR, so squash the two. The body also leaves out that it deletes Makefile.standalone/Makefile.upstream and the uci-defaults script, removes the makedir/removedir subcommands, and rewrites LICENSE, README and the translations.

Generated by Claude Code

openwrt-ai · 2026-10-13T05:56:05Z

+}
+ovpnservice_worker() {
+	shift # Remove "ovpnservice_worker" from the arguments list
+	local pid_file="$1"


The *_worker subcommands are reachable from the RPC exec grant, and they take pid_file from argv and rm -f it on exit. That means ovpnservice_worker /etc/config/firewall x deletes any file and bypasses internal_securepath. Hard-code the pid path inside each worker (lines 1950, 1970 and 1989 too), and validate instance before keygen_async builds /var/run/openvpn.keygen-${instance}.pid from it at line 1984.

Generated by Claude Code

openwrt-ai · 2026-10-13T05:56:08Z

+		if (skipTrim === true) {
+			return res.stdout.trim();
+		} else {
+			return res.stdout.trim();
+		}


Both branches trim, so skipTrim does nothing, even though the readfile/readstatus callers pass true to keep whitespace. The same applies to openvpn-status.js lines 177-181.

Suggested change

if (skipTrim === true) {

return res.stdout.trim();

} else {

return res.stdout.trim();

}

return (skipTrim === true) ? res.stdout : res.stdout.trim();

Generated by Claude Code

openwrt-ai · 2026-10-13T05:56:10Z

+	ucisortovpn)	ucisortovpn ;;
+	cleanup)        cleanup "$@" ;;
+	keymeta)        keymeta "$@" ;;
+	keygenclean)	keygenclean ;;


keygenclean() now starts with shift, but it is called here without arguments, so the shift fails on an empty parameter list. Pass "$@" as the other dispatch entries do.

Suggested change

keygenclean) keygenclean ;;

keygenclean) keygenclean "$@" ;;

Generated by Claude Code

feckert · 2026-10-13T06:05:39Z

To be honest, I'm not entirely comfortable with the fact that we're using NFT commands directly here. Either we attach this to the service via a separate firewall object. see -> https://github.com/search?q=repo%3Aopenwrt%2Fpackages+json_add_array+firewall&type=code, or we write it into the fw4 hooks so that fw4 includes it when it loads. -> see https://openwrt.org/docs/guide-user/firewall/firewall_configuration#drop-in_includes_for_package_authors.

openwrt Bot added add package Introduces a new package Makefile build script not following guidelines Pull request does not follow formatting guidelines labels Oct 10, 2026

masmbit force-pushed the luci-app-openvpn-plus branch 2 times, most recently from f41c0e1 to 1ddf91f Compare October 10, 2026 23:03

masmbit force-pushed the luci-app-openvpn-plus branch from 1ddf91f to e032a2c Compare October 10, 2026 23:11

openwrt Bot removed the not following guidelines Pull request does not follow formatting guidelines label Oct 10, 2026

openwrt-ai reviewed Oct 11, 2026

View reviewed changes

BKPepe requested changes Oct 11, 2026

View reviewed changes

openwrt Bot added the not following guidelines Pull request does not follow formatting guidelines label Oct 12, 2026

masmbit force-pushed the luci-app-openvpn-plus branch from f5ebc4a to 30ffbd5 Compare October 12, 2026 01:38

openwrt Bot removed the not following guidelines Pull request does not follow formatting guidelines label Oct 12, 2026

This comment was marked as resolved.

Sign in to view

masmbit requested a review from BKPepe October 13, 2026 00:20

masmbit force-pushed the luci-app-openvpn-plus branch from 30ffbd5 to fa1eccb Compare October 13, 2026 00:42

openwrt-ai reviewed Oct 13, 2026

View reviewed changes

feckert reviewed Oct 13, 2026

View reviewed changes

Conversation

masmbit commented Oct 10, 2026

Pull request details

Description

Screenshot

Maintainer

Tested on

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BKPepe left a comment

Choose a reason for hiding this comment

Uh oh!

masmbit commented Oct 11, 2026

Uh oh!

masmbit commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

openwrt-ai left a comment

Choose a reason for hiding this comment

Commit checks

Uh oh!

openwrt-ai Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

openwrt-ai Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

openwrt-ai Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

feckert Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

masmbit commented Oct 12, 2026 •

edited

Loading