How to make TRAMP aware of VPNs?

Question

For work I sometimes have to connect to our enterprise VPN.

When inside of the VPN, I can reach host remote per SSH, so the following TRAMP incantation works:

C-x C-f /ssh:remote:/path/filename RET

Whereby remote's user and full hostname are specified in my .ssh config so TRAMP magically handles that.

When outside of the VPN, I can still reach host remote provided I hop through entry. So the following would work:

C-x C-f /ssh:entry|ssh:remote:/path/filename RET

My question is:

Can I have TRAMP automatically convert "ssh:remote" to "ssh:entry|ssh:remote" only when I'm not connected to the VPN? Ultimately I'd like existing connections to files to also be updated upon TRAMP cleanup connections. Currently disconnecting from the VPN is a real pain but I can't be connected all the time because the VPN lease resets every now and then.

Answer 1

The answer to any engineering question that starts with “Can I have…” is almost always yes. The real question is how much work it will take, and whether it is worth it.

You haven’t said what operating system you are using, which is absolutely vital information; everything else depends on it. So I will just assume that you made the most sane choice, and are using Linux.

NetworkManager knows whether you are connected and how, so you should be querying it for the status of the VPN. I can’t give you complete details about it, but if you just wanted to know if you are connected at all, you could use this function:

(defun nm-is-connected()
  (equal 70 (dbus-get-property :system
                               "org.freedesktop.NetworkManager"
                               "/org/freedesktop/NetworkManager"
                               "org.freedesktop.NetworkManager"
                               "State")))

You can read the NetworkManager documentation for all the details about the dbus API it provides.

Emacs has a number of features that you can use in combination with Tramp so that you can type something short and Tramp will open a much longer filename. They are all briefly documented in the Tramp FAQ. Look for the question titled “How to shorten long file names when typing in TRAMP?”; it has no anchor so I cannot link to it directly.

So, pick a method for shortening your long and complex file name, and then combine it with the state of your VPN. Choose wisely: some of these methods are more amenable to this type of complex customization that others. For example, some of these methods only allow you to replace one string with another, while other methods may allow you to specify a function that will be called to generate the replacement. You will need to research each of these methods until you find the one which is most appropriate.

But the question remains; it may not be a good idea to do all of this work. If you can reach your jump host even while connected to the VPN, then it may just be easier to always use the jump host even when it isn’t necessary. It won’t be any less secure, and it will simplify your life.

In particular, this makes method #3 much more attractive. If you specify the ProxyJump configuration option in your ssh config file, then it will always be used for all ssh connections to the remote host:

Host remote
    Hostname remote.example.com
    ProxyJump entry.example.com

Then you can always just use the shorter form to connect using Tramp:

C-x C-f /ssh:remote:/path/filename RET