Zonemaster is a great tool to verify that you have set up your domainservers correctly. You can test it out on https://zonemaster.iis.se/en/
I want my icinga server to this automaticly so i will get a warning as soon something changes, so lets do that. First thing you need to now is that Zonemaster is a tool and is freely available on Github. you can download it and run it on your own machine.
NRPE will not start if its server address is a openvpn ip and the tunnel is not yet established when NRPE tries to start. to solve this. create a new systemd file
systemctl -all | grep ovpn cp /usr/lib/systemd/system/nrpe.service /etc/systemd/system/nrpe.service
Add your tun device to Requires and After. Note you need the systemD name of your tune device. in this case. OpenVPN was configured to use tun ovpn-gwSamuel check systemctl for its correct name. The result should look something like this. Notice the esacped dash sign in the name.
[Unit] Description=Nagios Remote Program Executor Documentation=http://www.nagios.org/documentation Conflicts=nrpe.socket Requires=network.target sys-devices-virtual-net-ovpn\x2dgwSamuel.device After=network-online.target sys-devices-virtual-net-ovpn\x2dgwSamuel.device [Install] WantedBy=multi-user.target [Service] Type=forking User=nrpe Group=nrpe EnvironmentFile=/etc/sysconfig/nrpe ExecStart=/usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -d $NRPE_SSL_OPT