Posted on
• Artificial Intelligence

AI-Assisted VPN Troubleshooting

Author
  • User
    linuxbash
    Posts by this author
    Posts by this author

AI-Assisted VPN Troubleshooting: Faster Fixes From Your Bash Prompt

Ever been on-call when “the VPN is down” and the only clues are a wall of logs and a frantic Slack thread? What if you could turn that noise into a short, prioritized checklist—complete with the exact Bash commands to confirm root causes—within minutes? That’s the value of AI-assisted VPN troubleshooting: you stay in control, but let a model accelerate the boring parts—log summarization, hypothesis generation, and command drafting—so you can fix issues faster.

In this post, you’ll learn a practical, Bash-first workflow to pair your Linux tools with an AI assistant. We’ll cover safe data collection and redaction, how to ask the right questions, and concrete examples for OpenVPN and WireGuard. You’ll also get ready-to-run command snippets and install instructions for apt, dnf, and zypper.

Why AI for VPN Troubleshooting?

  • VPN outages are multi-layered: identity/auth, crypto, routing, firewall, DNS, MTU, and provider quirks. Logs are verbose and often inconsistent across clients/servers.

  • LLMs can quickly:

    • Extract timelines and error patterns from logs.
    • Propose ranked root causes and targeted verification commands.
    • Explain iptables/nftables rules or WireGuard/OpenVPN options in plain English.

  • You still verify and run commands. AI boosts signal and speed; you remain the operator.

Quick-Install: Core Toolkit

The following tools cover most client-side diagnostics:

  • openvpn, wireguard-tools

  • curl, jq

  • mtr, traceroute

  • tcpdump

  • dig (dnsutils/bind-utils)

  • Optional: python3-pip to install an AI CLI

Debian/Ubuntu (apt):

sudo apt update
sudo apt install -y \
  openvpn wireguard-tools \
  curl jq \
  mtr-tiny traceroute \
  tcpdump dnsutils \
  python3-pip

Fedora/RHEL/CentOS (dnf):

sudo dnf install -y \
  openvpn wireguard-tools \
  curl jq \
  mtr traceroute \
  tcpdump bind-utils \
  python3-pip

openSUSE (zypper):

sudo zypper refresh
sudo zypper install -y \
  openvpn wireguard-tools \
  curl jq \
  mtr traceroute \
  tcpdump bind-utils \
  python3-pip

Optional: a local or cloud LLM CLI. Two common paths:

  • Local model runner (no cloud): e.g., install via upstream script:

    curl -fsSL https://ollama.com/install.sh | sh

  • Python-based CLI (works with many providers or local OpenAI-compatible servers):

    python3 -m pip install --user aichat

    Then configure your endpoint/API key per its docs, or point it at a local OpenAI-compatible server.

In examples below, replace your-llm-cli with whatever you installed (e.g., aichat).

1) Collect and Sanitize Diagnostics (So AI Can Help Safely)

Start with a repeatable evidence bundle. This script gathers logs and state, then redacts IPs/domains before packaging. Review and tailor redaction rules to your environment.

#!/usr/bin/env bash
set -euo pipefail

OUT="vpn-diag-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUT"

# Logs: journal and files (adjust paths as needed)
journalctl -u openvpn --no-pager -n 2000 > "$OUT/openvpn.journal.log" 2>/dev/null || true
journalctl -u wg-quick@wg0 --no-pager -n 2000 > "$OUT/wg.journal.log" 2>/dev/null || true
[ -f /var/log/openvpn.log ] && tail -n 2000 /var/log/openvpn.log > "$OUT/openvpn.file.log" || true

# Runtime state (no private keys exposed)
wg show all > "$OUT/wg-show.txt" 2>/dev/null || true
ip addr show > "$OUT/ip-addr.txt"
ip route show table all > "$OUT/ip-route.txt"
ip rule show > "$OUT/ip-rule.txt"
resolvectl status > "$OUT/resolvectl.txt" 2>/dev/null || cat /etc/resolv.conf > "$OUT/resolv.conf.txt"

# Firewall (best effort)
{ nft list ruleset || true; } > "$OUT/nft.txt"
{ iptables -S || true; } > "$OUT/iptables.txt"

# Recent connectivity
curl -sS --max-time 5 https://ifconfig.me > "$OUT/public-ip.txt" || true

# Redact naive IPv4 addresses and domains (tune for your org!)
for f in "$OUT"/*; do
  sed -E -i \
    -e 's/[0-9]{1,3}(\.[0-9]{1,3}){3}/X.X.X.X/g' \
    -e 's/([[:alnum:]-]+\.)+[[:alpha:]]{2,}/redacted.domain/g' \
    "$f"
done

tar czf "$OUT.tgz" "$OUT"
echo "Created $OUT.tgz (sanitized). Inspect before sharing with AI."

Tip: Never paste private keys, tokens, or internal hostnames you haven’t redacted. When in doubt, keep logs local and use a local LLM.

2) Prompt the AI Like an SRE

Give structure and constraints. Provide only what’s needed.

Prompt template:

You are a Linux VPN SRE. Be concise and practical.
Context:

- Client OS: <distro/version>

- VPN type: <OpenVPN|WireGuard>

- Symptoms: <e.g., connects then no routes, handshake timeout, AUTH_FAILED>

- When it started: <timestamp/timezone>

- What changed: <package upgrade, new firewall, new ISP, etc.>

Artifacts (sanitized):
---BEGIN LOGS---
<tail -n 300 from your sanitized log>
---END LOGS---
---BEGIN STATE---
<key lines from wg show / ip route / resolvectl>
---END STATE---

Tasks:
1) Summarize the failure timeline and the 1–3 most likely root causes (ranked).
2) Output concrete Bash commands to verify each cause (read-only first when possible).
3) Suggest minimal, reversible fixes if a cause is confirmed.
4) Note any risky commands.

Pipe logs into your client:

tail -n 400 openvpn.journal.log | your-llm-cli -p '...the template above...'

3) Turn AI Suggestions Into Verified Checks

Ask the model to draft commands, then you run and validate. Examples:

  • Routing and DNS checks:
ip route show
resolvectl status  # or: cat /etc/resolv.conf
dig example.com @1.1.1.1 +short
  • MTU discovery (path MTU to common endpoints):
# Lower until it works; 1472 is typical for 1500 MTU minus UDP+IP.
sudo ping -M do -s 1472 1.1.1.1 -c 1 || echo "Try smaller -s"
  • WireGuard socket and traffic:
sudo ss -u -lpn | grep 51820
sudo tcpdump -ni any udp port 51820 -c 20
sudo wg show
  • OpenVPN verbose attempt:
sudo openvpn --config /path/to/client.ovpn --verb 4 --connect-retry-max 2
  • Firewall diff (explain with AI if needed):
sudo nft list ruleset | sed -n '1,120p'

Then paste a snippet and ask the AI to explain how it affects UDP 51820 or tun0.

4) Real-World Scenarios (With Commands And AI Angles)

A) OpenVPN AUTH_FAILED

  • Symptom: connection aborts with AUTH_FAILED in logs.

  • Likely causes: bad creds, account lock/2FA mismatch, time skew (TLS).

  • Verify:

grep -i 'auth' openvpn.*.log | tail -n 50
timedatectl status
# If using auth-user-pass file:
stat -c "%a %n" /path/to/auth.txt  # permissions too open can be blocked

  • Fix ideas:

    • Re-enter creds; ensure auth-nocache if required by policy.
    • Confirm time sync:
    sudo timedatectl set-ntp true
    • If server uses PAM/LDAP/2FA, coordinate with Identity/Infra.

  • AI assist: Paste last 200 lines and ask for the minimal set of verification commands and whether TLS time skew is plausible from the log timestamps.

B) WireGuard Handshake Timeouts

  • Symptom: “Handshake for peer did not complete” or zero RX on interface.

  • Likely causes: wrong endpoint/keys, UDP blocked/NAT issue, AllowedIPs mismatch, firewall drop.

  • Verify:

sudo wg show
sudo ss -u -lpn | grep 51820
sudo tcpdump -ni any udp port 51820 -c 50
ip route get <peer_public_ip>

  • Quick checks:

    • Keys/peers: ensure correct public key on each side.
    • AllowedIPs: no overlapping that black-holes traffic.
    • Firewall: allow UDP 51820 inbound on server; MASQUERADE if it’s a gateway.

  • AI assist: Ask the model to read wg show + nftables snippet and produce a minimal rule set that allows UDP 51820 and NATs 10.0.0.0/24 out, then you implement and test.

C) Connected But No DNS/Leaking DNS

  • Symptom: traffic works by IP, fails by name, or queries bypass VPN.

  • Verify:

resolvectl status  # which link is default? per-link DNS?
dig whoami.cloudflare @1.1.1.1 +short
# Force over VPN interface (adjust wg0/tun0 as needed)
curl --interface wg0 https://1.1.1.1/cdn-cgi/trace --max-time 5

  • Fix ideas:

    • For systemd-resolved: push correct DNS via VPN and ensure routing to DNS through the tunnel.
    • OpenVPN: use dhcp-option DNS <ip> and redirect-gateway def1 if full-tunnel.
    • WireGuard: ensure DNS is configured per interface (NetworkManager or resolv.conf management).

  • AI assist: Provide resolvectl output and routing table; ask for a minimal change to route only 53/853 to VPN DNS while keeping split-tunnel.

D) MTU/MSS Trouble (Stalls, Slow TLS)

  • Symptom: small pings work; web stalls or only some sites load.

  • Verify path MTU:

# Find max payload without fragmentation
for s in 1472 1460 1400 1380 1360; do
  echo "Testing $s"; ping -M do -s $s 8.8.8.8 -c 1 && break
done

  • Fix ideas:

    • WireGuard: set MTU in wg-quick config, e.g., MTU = 1380.
    • OpenVPN: try tun-mtu 1400 and mssfix 1360 (coordinate with server).

  • AI assist: Ask for the recommended MTU/MSS given your observed max payload and link type (PPPoE, LTE, etc.), then validate.

5) Let AI Draft a “Next Checks” Ladder

When you’re stuck, give the model:

  • The sanitized last 200 lines of logs.

  • wg show or openvpn --verb 4 highlights.

  • ip route, resolvectl status, and a description of what works/doesn’t.

Ask it to:

  • Produce the next 5 checks in order, with shell commands.

  • Mark any commands that change system state.

  • Explain how each result narrows root cause.

Then copy/paste and run them locally, recording outputs in your diag folder.

A Lightweight Runbook You Can Keep

  • A single collector script (above) for consistent artifacts.

  • A standard prompt template for your team.

  • A local LLM where possible for privacy and low latency.

  • A “trust but verify” ritual: never run state-changing commands without reading them.

Conclusion and Next Steps

AI won’t replace your network intuition, but it can compress hours of log-gazing into minutes. Start building an AI-augmented runbook today:

1) Install the toolkit (openvpn, wireguard-tools, curl, jq, mtr/traceroute, tcpdump, dnsutils/bind-utils, python3-pip) with apt/dnf/zypper. 2) Save and customize the collector/redaction script. 3) Pick an LLM CLI (local or cloud) and test the prompt template on a known-good/bad case. 4) Iterate: capture what works and bake it into your team’s SOP.

If this helped, consider turning your collector and prompts into a shared repo for your org. The next time someone says “VPN is flaky,” you’ll have a fast, privacy-conscious, Bash-first answer—supercharged by AI.

Related posts