multiple clients connect to different networks

petersonnn

Hello,
I have a problem configuring OpenVPN for multiple clients accessing multiple networks.

The scenario is the following:
server's lan- 10.10.0.0/24
client1 connects to 10.10.1.0/24
client2 connects to 10.10.2.0/24
client3 connects to 10.10.3.0/24
...etc.
The problem is that I need different users to use the same certificate (and user/pass) which were generated for client1 for example. In that case I'll need a range of IP addresses for the users who use the same client's credentials.

I read "Configuring client-specific rules and access policies" from How-to section but if I follow it I have to use fixed IP address for any client.

Is there a way to give any client a specific range of IP addresses and multiple users to use the same client's certificate?

I know I can accomplish that if I use different servers but I will have 100 clients so it's not appropriate to have 100 servers.

Thanks in advance!

janjust

if multiple users share the same cert/keypair AND use the same username/password then how can the openvpn server distinguish between them? if it cannot distinguish between them it cannot assign different IPs from different subnets.

petersonnn

According to documentation the option "duplicate-cn" allows multiple clients with the same common name to concurrently connect.

And the question is "Is it possible multiple users who use the same common name to get IP from a specific IP range? And another group of users who share another common name to get another IP address range?"

If each user had his own cert/key I would use for ex.:
ifconfig-push 10.8.1.1 10.8.1.2

But since this option allows only one IP address for a common name (mask 30) I cannot use it for common names used by multiple users.

In general my problem is how to make possible 100 (or less) clients to have IPs from the same number of networks. Any of these clients' credentials should be shared by a different group of people.
ex.:
client1 (cert/key shared by 10 people) get IP from 10.10.1.0/24
client2 (cert/key shared by 10 people) get IP from 10.10.2.0/24
etc...

Thanks!

janjust

According to documentation the option "duplicate-cn" allows multiple clients with the same common name to concurrently connect.

yes but then you can NOT assign IP addresses from different ranges AND this option is not recommended as it is a (minor) security risk.