fixed von IP based on remote-address

h.reindl

Hi

we are using openvpn since more than a year and are quite happy
since their are only few users we have a shared key, all fine

now we have two linux stations which are connecting to openvpn at boot
and forwarding the network behind the vpn-server in their LAN which
works also like a charme

BUT is there a simple way to tell openvpn as example if the remote
address is 84.113.45.179 that it should always get a specific IP
out of the 10.1.0.241 10.1.0.252 or even like a by MAC assigend
DHCP address oustide from the dynamic pool?

currently i can only achive this after updates by starting the server
and both clients in the right order and if they got the wrong one
restart openvpn on the client - background is a static route inside
the VPN network to the LAn of the client

# We are working as server
mode server
tls-server

# Which TCP/UDP port should OpenVPN listen on?
port 1194

# TCP or UDP server?
proto udp

# Protocol options
tun-mtu 1500
mssfix
key-method 2

# tun is an IP tunnel,
# tap an ethernet tunnel and used with bridges
dev tap0

# SSL/TLS root certificate (ca)
# certificate (cert), and private key (key).
# Each client and the server must have their own cert and key file.
# The server and all clients will use the same ca file.
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
tls-auth /etc/openvpn/ta.key 0

# Diffie hellman parameters.
dh /etc/openvpn/dh1024.pem

# auth method
auth SHA1

# encryption method
cipher AES-256-CBC

# TAP-Configuration
server-bridge 10.1.0.134 255.255.255.0 10.1.0.241 10.1.0.252

# Uncomment this directive to allow different
# clients to be able to "see" each other.
client-to-client

# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names.
duplicate-cn

# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
keepalive 3 10

# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
comp-lzo

# The maximum number of concurrently connected
# clients we want to allow.
max-clients 20

# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
user nobody
group nobody

# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun

# Logging and chroot
status /var/log/openvpn/openvpn-status.log
log  /var/log/openvpn/openvpn.log
chroot /var/log/openvpn

# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

# Silence repeating messages.
mute 20

# do not allow user-defined scripts
script-security 1

janjust

you can use either a 'client-config-dir' file for this, or you can write a 'client-connect' script. Read the manual page for details.
Your best bet is to assign an IP address based on the name of the client certificate.

Note that the only client MAC address known to the openvpn server is that of the tap adapter, and on Linux this MAC address changes after every reboot...