Managing Enterprise VPN using Pritunl API CLI

Introduction

When you are in the advanced field of system administration, you always think, “Is there a CLI feature for this?” in a scenario where simple tasks like adding or modifying having a repeating process are relatively less attractive throughout the period. With the help of the Command line interface and mild scripting, we can accomplish primary things in terms of automating simple repetitive tasks.

In this post, we can manage an enterprise VPN using the Pritunl API CLI, such as creating, retrieving, and updating users and a few other CLI features.

Quick Demo

Recorded with asciinema asciinema

Installation

Pritunl API CLI is already part of the Pritunl API Client for Python; to enable it, we all need to allow extra CLI during the PIP installation. The PIP extra cli will install the necessary libraries for our CLI feature.

Install via PyPI Package

pip install pritunl-api[cli]

The CLI will automatically be available in your distribution $PATH. Try to validate that the CLI distribution is accessible by invoking the command.

pritunl-api-cli --help
Usage: pritunl-api-cli [OPTIONS] COMMAND [ARGS]...

  Pritunl API CLI

Options:
  --version  Show the version and exit.
  --help     Show this message and exit.

Commands:
  api
  user

pritunl-api-cli --version
pritunl-api-cli, version x.x.x

Configuration

API Endpoint and Credentials Setup

Set the Pritunl API CLI environment variables.

export PRITUNL_BASE_URL="https://vpn.domain.tld/"
export PRITUNL_API_TOKEN="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
export PRITUNL_API_SECRET="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

Test the connection to see if the API endpoint and credentials work correctly.

pritunl-api-cli api status
{
  "org_count": 1,
  "users_online": 0,
  "user_count": 0,
  "servers_online": 1,
  "server_count": 1,
  "hosts_online": 1,
  "host_count": 1,
  "server_version": "1.30.3354.99",
  "current_host": "XXXXXXXXXXXXXXXXXXXXXX",
  "public_ip": "###.###.###.###",
  "local_networks": [
    "172.31.80.0/20"
  ],
  "notification": ""
}

CLI Usage

User Feature

pritunl-api-cli user
Usage: pritunl-api-cli user [OPTIONS] COMMAND [ARGS]...

Options:
  --help  Show this message and exit.

Commands:
  create
  delete
  get
  update

Create User

pritunl-api-cli user create
Usage: pritunl-api-cli user create [OPTIONS]

  Pritunl Create User

Options:
  --org-name TEXT
  --user-name TEXT
  --user-email TEXT
  --pin TEXT
  --yubikey-id TEXT
  --from-csv PATH
  --help             Show this message and exit.

Create a Single User

pritunl-api-cli user create \
  --org-name pritunl-dev \
  --user-name john.doe \
  --user-email [email protected]

Create a sets of User from CSV file

pritunl-api-cli user create \
  --from-csv ./users.csv

Get User

pritunl-api-cli user get
Usage: pritunl-api-cli user get [OPTIONS]

  Pritunl Get User

Options:
  --org-name TEXT
  --user-name TEXT
  --all-users
  --show-advanced-details
  --help                   Show this message and exit.

Get a Single User

pritunl-api-cli user get \
  --org-name pritunl-dev \
  --user-name john.doe

Showing the advanced details of a user in JSON output.

pritunl-api-cli user get \
  --org-name pritunl-dev \
  --user-name john.doe \
  --show-advanced-details

Get Users from an Organization

pritunl-api-cli user get \
  --org-name pritunl-dev \
  --all-users

Showing the advanced details of a users in JSON output.

pritunl-api-cli user get \
  --org-name pritunl-dev \
  --all-users \
  --show-advanced-details

Update User

pritunl-api-cli user update
Usage: pritunl-api-cli user update [OPTIONS]

  Pritunl Update User

Options:
  --org-name TEXT
  --user-name TEXT
  --pin TEXT
  --yubikey-id TEXT
  --disable / --enable
  --help                Show this message and exit.

Update a User for a New PIN

pritunl-api-cli user update \
  --org-name pritunl-dev \
  --user-name john.doe \
  --pin 123456

Disable a User

pritunl-api-cli user update \
  --org-name pritunl-dev \
  --user-name john.doe \
  --disable

Enable a User

pritunl-api-cli user update \
  --org-name pritunl-dev \
  --user-name john.doe \
  --enable

Delete User

pritunl-api-cli user delete
Usage: pritunl-api-cli user delete [OPTIONS]

  Pritunl Delete User

Options:
  --org-name TEXT
  --user-name TEXT
  --help            Show this message and exit.

Delete a User

pritunl-api-cli user delete \
  --org-name pritunl-dev \
  --user-name john.doe

Connection and Testing

Pritunl Client

Install the Pritunl Client for our Pritunl API CLI created users and the keys it generated.

Pritunl Client CLI

The pritunl-client package is available when installing the Pritunl Client

Add a Profile

pritunl-client add pritunl://vpn.domain.tld/ku/8u2KK6rZ

List of Profiles

pritunl-client list

Start a Connection

pritunl-client start zmza0w2jbqidtp5f --mode wg

Stop a Connection

pritunl-client stop zmza0w2jbqidtp5f

Delete a Profile

pritunl-client delete zmza0w2jbqidtp5f

Validate Connection

This a neat and quick way to test if your connection routes to your Local ISP or in the VPN Cloud Vendor.

curl -s ipinfo.io/`curl -s ifconfig.me` | jq