multiple clients in different subnets, assign subnet per ccd

zmi

Hi, this is a bit more complicated, at least for me. I hope others are more fit on OpenVPN than I am?

My setup on the server is this:
172.16.0.0/13 should be reachable nets
172.24.0.0/13 are VPN subnets, BUT:
- depending on which client connects, I want that client to get an IP from a specific subnet. All I found so far is using the "ccd" dir to give an IP via "ifconfig" to each client.
- clients are grouped in /24 subnets, so my firewall setup is easier
- clients only get access to one /24 subnet of 172.16.0.0/13, so I need a "push" command in ccd as well

Example:
Client A should get an IP from 172.24.0.0/24, and access to 172.16.0.0/24
Client B should get an IP from 172.24.1.0/24, and access to 172.16.1.0/24
Client C should get an IP from 172.24.2.0/24, and access to 172.16.2.0/24

Now I have the "ccd" files like this:
ccd/A:

ifconfig-push 172.24.0.9 172.24.0.10
push "route 172.16.0.0 255.255.255.0 vpn_gateway"

(you can guess the files for client B and C I guess)

The problems:
- The client does NOT set the route to 172.16.0.0, as "Warning: route gateway is not reachable on any active network adapters: <gateway>". I've tried with the <gateway> IPs of 172.24.0.9, 172.24.0.10, 172.24.0.1. Nothing works. Route does not get set.
- Is it not possible to say in ccd "give this client an IP of range 172.24.0.0/24"? That would be nice for easier manageability. Something like "ifconfig-push 172.24.0.0/24".
- why is it not sufficient to say

push "route 172.16.0.0 255.255.255.0"

on the client and it gets it's VPN gateway IP itself? Maybe my "server" statement is wrong?

Here are the relevant bits of the SERVER config:

dev tun
tls-server (with all keys etc. - this works)
topology subnet
server 172.24.0.0 255.248.0.0 (I patched pool.h so this works)
ifconfig-pool-persist ipp.txt
client-config-dir ccd-cust
(then follow the usual keepalive etc. but this all works)

The CLIENT.OVPN looks like this:

cert A.crt
key A.key (per client keys permit the use of ccd)
client
dev tun
tls-client (along with all certs)
remote SERVER <port> udp

janjust

try this in the CCD file:

ifconfig-push 172.24.0.10 172.24.0.9
push "route 172.16.0.0 255.255.255.0"

the IPs should be reversed, and yes, you do not need to supply 'vpn_gateway' - that option is needed only if you want to overrule the default metric for a VPN route.

zmi

I found the problem to be in

topology subnet

although the man page says it is OK to use even with Windows clients. It works now.

As to your comment:

ifconfig-push 172.24.0.9 172.24.0.10
ifconfig-push 172.24.0.10 172.24.0.9

Does it really matter which one is first? When I spec it at the ccd file with 9 first, the client gets 9, and with 10 first it gets 10, and the server 9. It should not really matter I guess. But it's good you reminded me about that, thanks.

As I said it works now, but from the server 172.16.x.x I cannot reach the client on 172.24.x.x. A traceroute shows that the server uses the route to the openvpn server, but then the access doesn't work, although the firewall would permit it. Also from the openvpn server directly, I cannot ping the VPN client. What is needed in the config?

Mimiko

Did you check that client has firewall disabled for IGMP? What are iptables rules?