CloudConnexa: Disconnect Idle VPN Sessions with the inactive Directive

Overview

You can automatically disconnect idle VPN sessions in CloudConnexa by using the inactive directive.

This directive terminates a VPN connection when traffic remains below a defined threshold for a specified time period.

Example:

inactive 60 1000000

• 60 = inactivity timer in seconds

• 1000000 = traffic threshold in bytes (~1MB)

If traffic stays below 1 MB for 60 seconds, the VPN session disconnects.

Note: These values are examples. Adjust both the timeout and byte threshold based on your environment and usage patterns.

Configure a global idle timeout

To apply this setting to all VPN sessions:

1. Go to CloudConnexa → Settings → WPC → Advanced Options.
2. Add the directive under OpenVPN Client Options.

Important considerations

When applied globally, the inactive directive affects all OpenVPN connection sessions, including:

• User connections.

• Network Connectors.

That can affect Connector stability. If a Connector doesn't pass enough traffic, it may disconnect unintentionally.

Exclude specific profiles from the idle timeout

To prevent a specific profile (such as a Connector) from being disconnected, you need to modify that profile and add:

pull-filter ignore inactive

This overrides the global inactive setting for that specific connection.

Follow the steps in the next section to locate and update the correct profile on your operating system.

Configure profile exclusions by platform

Windows

OpenVPN Connect profiles

If you aren't using the OpenVPN service for Connectors:

1. Open %APPDATA%\OpenVPN Connect\profiles.

2. Open the profile you want to update in a text editor.

3. Add pull-filter ignore inactive.

4. Save the file.

Windows Connector service profiles

If you use the OpenVPN service binary for automatic Connector startup, update the service's profile.

Refer to the Windows Connector tutorial to identify the profile path, then add pull-filter ignore inactive to that profile.

macOS

1. Open ~/Library/Application Support/OpenVPN Connect/profiles/.

2. Open the profile you want to update in a text editor.

3. Add pull-filter ignore inactive.

4. Save the file.

Linux

For Linux Connectors that use OpenVPN 3, export the existing profile, add the directive, re-import it, and restart the session.

Note: If you use an older deployment or a custom profile name, replace CloudConnexa with the profile name that sudo openvpn3 sessions-list shows.

set -e 
CONFIG_NAME='CloudConnexa'
sudo openvpn3 session-manage --config "$CONFIG_NAME" --disconnect
sudo openvpn3 config-dump --config "$CONFIG_NAME" > /tmp/profile.ovpn
echo 'pull-filter ignore inactive' >> /tmp/profile.ovpn
sudo openvpn3 config-remove --config "$CONFIG_NAME" --force
sudo openvpn3 config-import --config /tmp/profile.ovpn --name "$CONFIG_NAME" --persistent
sudo rm /tmp/profile.ovpn
sudo openvpn3 session-start --config "$CONFIG_NAME"

When to use the inactive directive

Use the inactive directive when you want to:

• Disconnect idle user sessions.

• Free up resources from inactive connections.

• Enforce stricter session lifecycle policies.

⚠️ Best Practice

Because this directive also affects Connectors when configured globally:

• Test in a non-production environment first.

• Use profile exclusions where needed.

• Monitor Connector behavior after enabling.