Feature Request: Apply route changes without restarting the server (live/hot reload)

Pritunl Pritunl VPN
,
1

Hi Zach,

first of all, thanks for Pritunl. We’ve been using it for a while and are very happy with it overall.

One limitation keeps coming up for us and many other users: changing routes currently requires a server restart, which disconnects every connected client. With around 70 active users, that means interrupting everyone at once. In production that is a real problem. Even a small change, like adding a single subnet, means disconnecting all users or postponing the change to a maintenance window.

The idea

I understand that some settings can’t be changed at runtime, for example the port, protocol or virtual network. Those require a restart by design, and that’s fine.

Routes (and similar push options such as DNS servers or search domains), however, could be applied without restarting the server process. OpenVPN already provides mechanisms that could support this:

  • client-config-dir (CCD): CCD files are read when a client connects, not at server start. Pushing routes through CCD (or a similar per-connection mechanism) would apply new routes to every client that connects after the change, without touching existing sessions.
  • Management interface: Already connected clients could optionally be told to reconnect (e.g. via client-kill with a restart signal), either all at once or gradually, so they pick up the new routes. The admin could decide whether that happens immediately or only on the client’s next natural reconnect.
  • PUSH_UPDATE in OpenVPN 2.7: OpenVPN 2.7.0 introduced PUSH_UPDATE, which can update routes, DNS, MTU and IP settings on existing sessions without any reconnect. The server side is exposed through the new management commands push-update-broad and push-update-cid. I’m aware the server-side support is still described as minimal, it requires 2.7 clients, and it’s currently disabled when DCO is active. So it may not be usable everywhere yet, but it could be a great option for the future, with the reconnect approach as a fallback.

Possible UI behavior

When an admin adds or removes a route on a running server, Pritunl could offer something like:

  1. “Apply to new connections only” (no interruption)
  2. “Apply and reconnect clients” (short reconnect per client instead of a full server restart)
  3. Later, where supported: “Apply live” via PUSH_UPDATE (no reconnect at all)

Why it matters

  • No downtime for routine network changes
  • Changes can be made during business hours
  • Much better fit for production environments with many users

This would be a real game changer for us and, judging by other requests, for many others as well. Would you consider adding this to the roadmap?

Thanks again for your work!