OpenVPN static IP address

[maxxer]

Hi.
I'm trying to assign a static IP to an OpenVPN client. I added in Client Specific Overrides a new rule with the openvpn username as common name, and in Advanced:

Code: [Select]

ifconfig-push 192.168.99.15 255.255.255.0

but it will always get the same (but different) address. Is this still supported? thanks

[knossos]

I also have a question concerning this setup that might be relevant for you as well:

With

Code: [Select]

ifconfig-push 192.168.99.15 255.255.255.0 you should assign the fixed IP address 192.168.99.15 to the client with the client specific override setting. For instance, in a certificate based scenario, the override would use the client certificate common name.


However, what happens if the same client has multiple devices and uses them to connect multiple times at the same time ?

In that case, IMHO the above configuration would only work a single time. If the user is already connected with a one device, the IP address will be taken. Hence if the user connects with another device at the same time, he would receive the same IP address again (192.168.99.15). Since the IP address is already taken for his first connection, I suppose the connection would fail.

So, is there a way to assign static IP address ranges to users ?

For instance, a user might have the fixed IP range 192.168.99.15 - 20.
Hence, the user could connect with up to 5 clients/devices at the same time. Each device would receive an address from the range 192.168.99.15 - 20. Any client specific firewall rules would thus consider the user's specific range.

Is this possible ?

Thanks !

[bartjsmit]

You can create multiple OpenVPN servers on different ports, each with its own (small) IP range. Effectively one server per (power) user.

Bart...

[maxxer]

I'm trying to assign a static IP to an OpenVPN client. I added in Client Specific Overrides a new rule with the openvpn username as common name, and in Advanced:

The procedure is correct, but for some reason (probably because by default the server allows the client to retain their IP) it's not immediately applied. I haven't had time to investigate further but it can take up to 4h.

The correct syntax is this:

Code: [Select]

ifconfig-push 192.168.99.15 192.168.99.14
if the Topology checkbox on the server configuration is unticked. If this is enabled the command should be ifconfig-push 192.168.99.15 255.255.255.0 but I'm not sure, I haven't tested

[lewald]

Use "Force CSO Login Matching" in vpn Server Settings.
Then client specfic override will work on user name.

And it will work 100 %

[maxxer]

Use "Force CSO Login Matching" in vpn Server Settings.
Then client specfic override will work on user name.

if this is for me thanks but I have no problem in matching the CN, now. I need to understand why the override isn't applied immediately