I'd like to have the server to NOT give any IP to a connecting client, there MUST be a ccd defined per client in order for it to get an IP. Is that possible? I want to make sure every client is configured correctly. Example: Server has [code]server 172.24.0.0 255.248.0.0[/code] but clients should always get a fixed IP from 172.24.1.0/24 or 172.24.2.0/24 etc. depending on in which group they are. The firewall then defines where they can go to. Currently, when I forget to define a ccd for a client, it would get any 172.24.x.x-172.31.x.x address, and that would be a mess.

do not assign IP by default - only via ccd?

zmi

I'd like to have the server to NOT give any IP to a connecting client, there MUST be a ccd defined per client in order for it to get an IP. Is that possible?
I want to make sure every client is configured correctly.

Example: Server has

server 172.24.0.0 255.248.0.0

but clients should always get a fixed IP from 172.24.1.0/24 or 172.24.2.0/24 etc. depending on in which group they are. The firewall then defines where they can go to.

Currently, when I forget to define a ccd for a client, it would get any 172.24.x.x-172.31.x.x address, and that would be a mess.

maikcat

you are looking for a directive named ccd-exclusive

cheers,

Michael.

zmi

Great, that should do the trick. Thx!

zmi

I have a working config: Clients must have a ccd file (ccd-exclusive), so per client I decide which IP it should get. But that is a PITA for administration: I must search all clients of a group to see which IPs are still free, and use lots of "ifconfig-push" directives. I'd like to have administration easier, maybe someone knows if I can do this:

- A client should get an IP from a specific subnet, lets say 172.24.1.0/16. I don't care which one, the server should choose and assign the next which is free. That way, I could use this ccd for all clients from a group belonging to this subnet, and not need to modify it.
- I'd also like to use "topology subnet", but that seems to not work for me. When I activate it, I can see the route on the client to the VPN subnet is displayed, but not used: The client uses it's default gw to reach that subnet. I take out "topology subnet", and it works again. What is the problem here?
- Together with topology subnet, it should be easy to configure a client to get an IP from a specific subnet, if only there would be the possibility to specify it. Something like "ifconfig 172.16.1.0/24" in the ccd should tell the server to handout an IP from that range that is available. Maybe it exists and I did not find it for now?

Mimiko

If you whant to use ccd to assign specific IP to clients, than you have to manually search and specify free IPs.