Please adivse on working config

janhoedt

Hi,

Love Openvpn! It is rock-solid and blazing fast!
However, I recently had some issues but they are solved by using the ccd-folder in which I added a static ip for my connection.
It worked fine for months till I had this issue. Therefore, I would like to optimize my config and would like to ask your advise on this.
Please comment/advise.
Note: main goal is to connect from anywhere with different devices and do this as secure as possible.

Client config:
-------------------
dev tun
tls-client

#remote mysite 8080, used this since proxies mostly allow port 8080

# If redirect-gateway is enabled, the client will redirect it's
# default network gateway through the VPN.
# It means the VPN connection will firstly connect to the VPN Server
# and then to the internet.
# (Please refer to the manual of OpenVPN for more information.)

#redirect-gateway
#auth-nocache

ifconfig-nowarn

#auto-proxy

pull

proto tcp-client
script-security 2

ca ca.crt

comp-lzo

reneg-sec 0

auth-user-pass

Server config:
----------------
DS210> vi openvpn.conf
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key

max-clients 5

comp-lzo

persist-tun
persist-key

verb 3

log-append /var/log/openvpn.log

keepalive 10 60
reneg-sec 0

plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCente
client-cert-not-required
username-as-common-name
duplicate-cn
proto tcp

Note: I found this in the connection log:

Tue Jun 19 13:32:04 2012 TCPv4_CLIENT link remote: remoteip:80
Tue Jun 19 13:32:04 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jun 19 13:32:05 2012 [Snake_Oil_CA] Peer Connection Initiated with remoteip:80
Tue Jun 19 13:32:08 2012 TAP-WIN32 device [Local Area Connection 30] opened: \\.\Global\{C352CA67-ED35-4952-867B-80BB6EA032F5}.tap
Tue Jun 19 13:32:08 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.33.6/255.255.255.252 on interface {C352CA67-ED35-4952-867B-80BB6EA032F5} [DHCP-serv: 192.168.33.5, lease-time: 31536000]
Tue Jun 19 13:32:08 2012 Successful ARP Flush on interface [131077] {C352CA67-ED35-4952-867B-80BB6EA032F5}
Tue Jun 19 13:32:13 2012 Initialization Sequence Completed

janjust

you mention ccd files yet I see nothing about them in the server config (nor was there a 'server' line)

Also, the client log shows

Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.33.6/255.255.255.252 on interface {C352CA67-ED35-4952-867B-80BB6EA032F5} [DHCP-serv: 192.168.33.5, lease-time: 31536000]

this means the client was assigned the first available IP from the pool 192.168.33.0/24 . Isn't this what you want?

janhoedt

Yes, that's exactly what I want. But something was causing issues recently. I assumed it was the fact that I didn't assign a fix ip and added the ccd, so I need to add something in serverconfig itself also?

Note: this was my errorlog:
Mon Jun 18 12:22:47 2012 myremoteclient:49760 Connection reset, restarting [0]
Mon Jun 18 12:22:47 2012 myremoteclient:49760 SIGUSR1[soft,connection-reset] rece
Mon Jun 18 12:22:47 2012 TCP/UDP: Closing socket

Problem was gone when I added the ccd folder + file.
I want to have dynamic ip but I guess root cause of my issue was that also remote gateway was sent over openvpn. Issue is gone now, but since you're telling me there is extra config to be done for static ip (I added ifconfig-push 192.168.33.5 192.168.33.6 and have now 33.6 as remote ip I guess I need to do something more?

janjust

if the remote gw is sent then the server is pushing out something like 'push "redirect-gateway def1"' ; adding a CCD file is not the proper solution if that is causing problems - you'd have to find out why the wrong GW is pushed. Show the full client connection log with 'verb 4' set and *without* the CCD file