Hi everyone
I have a small configuration issue with openvpn and i hope someone can help me.
I have an openvpn server running on an alix device. Everything works like expected apart from one thing.
I want to give the clients a fix ip address in the same network as the local network.
A few details about my network:
On my alix device runs my firewall (iptables) and openvpn. on eth0 is the internet and on eth1 is the local network. eth0 has 192.168.1.100 (it's not directly connected to the internet - it goes to an router), eth1 has 192.168.2.1.
My openvpn config right now looks like this:
port 11194
proto tcp
dev tun
ca xonet/ca.crt
cert xonet/server.crt
key xonet/server.key
dh xonet/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 20 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
verb 3
client-to-client
push "route 192.168.2.0 255.255.255.0"
#client-config-dir ccd
This works and the client gets an ip starting from 10.8.0.6. However, my local network is 192.168.2.0/24 and i want that every client gets a fix ip address. As you can see i already played around with "client-config-dir ccd". I created the "ccd" directory and greated a new config file for one client (hostname getafix).
majestix ccd #cat getafix
ifconfig-push 192.168.2.38 255.255.255.0
#push "route 192.168.2.0 10.8.0.0"
iroute 192.168.2.0 255.255.255.0
Here is the log from openvpn if ccd is enabled:
Aug 17 14:31:17 majestix openvpn[10627]: MULTI: multi_create_instance called
Aug 17 14:31:17 majestix openvpn[10627]: Re-using SSL/TLS context
Aug 17 14:31:17 majestix openvpn[10627]: LZO compression initialized
Aug 17 14:31:17 majestix openvpn[10627]: Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Aug 17 14:31:17 majestix openvpn[10627]: Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Aug 17 14:31:17 majestix openvpn[10627]: Local Options hash (VER=V4): 'c0103fa8'
Aug 17 14:31:17 majestix openvpn[10627]: Expected Remote Options hash (VER=V4): '69109d17'
Aug 17 14:31:17 majestix openvpn[10627]: TCP connection established with 89.144.192.72:64546
Aug 17 14:31:17 majestix openvpn[10627]: TCPv4_SERVER link local: [undef]
Aug 17 14:31:17 majestix openvpn[10627]: TCPv4_SERVER link remote: 89.144.192.72:64546
Aug 17 14:31:18 majestix openvpn[10627]: 89.144.192.72:64546 TLS: Initial packet from 89.144.192.72:64546, sid=c333b9bf cab8c871
Aug 17 14:31:24 majestix openvpn[10627]: 89.144.192.72:64546 VERIFY OK: depth=1, /C=AT/ST=OOE/L=...
Aug 17 14:31:24 majestix openvpn[10627]: 89.144.192.72:64546 VERIFY OK: depth=0, /C=AT/ST=OOE/L=...
Aug 17 14:31:25 majestix openvpn[10627]: 89.144.192.72:64546 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 17 14:31:25 majestix openvpn[10627]: 89.144.192.72:64546 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 17 14:31:25 majestix openvpn[10627]: 89.144.192.72:64546 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 17 14:31:25 majestix openvpn[10627]: 89.144.192.72:64546 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 17 14:31:26 majestix openvpn[10627]: 89.144.192.72:64546 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Aug 17 14:31:26 majestix openvpn[10627]: 89.144.192.72:64546 [getafix] Peer Connection Initiated with 89.144.192.72:64546
Aug 17 14:31:26 majestix openvpn[10627]: getafix/89.144.192.72:64546 OPTIONS IMPORT: reading client specific options from: ccd/getafix
Aug 17 14:31:26 majestix openvpn[10627]: getafix/89.144.192.72:64546 MULTI: Learn: 192.168.2.38 -> getafix/89.144.192.72:64546
Aug 17 14:31:26 majestix openvpn[10627]: getafix/89.144.192.72:64546 MULTI: primary virtual IP for getafix/89.144.192.72:64546: 192.168.2.38
Aug 17 14:31:26 majestix openvpn[10627]: getafix/89.144.192.72:64546 MULTI: internal route 192.168.2.0/24 -> getafix/89.144.192.72:64546
Aug 17 14:31:26 majestix openvpn[10627]: getafix/89.144.192.72:64546 MULTI: Learn: 192.168.2.0/24 -> getafix/89.144.192.72:64546
Aug 17 14:31:26 majestix openvpn[10627]: getafix/89.144.192.72:64546 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0'
Aug 17 14:31:28 majestix openvpn[10627]: getafix/89.144.192.72:64546 PUSH: Received control message: 'PUSH_REQUEST'
Aug 17 14:31:28 majestix openvpn[10627]: getafix/89.144.192.72:64546 SENT CONTROL [getafix]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 20,ping-restart 120,ifconfig 192.168.2.38 255.255.255.0' (status=1)
This configuration would work as expected. The client would get the ip "192.168.2.38" but then i can't access any local pcs anymore. (most importantly my nfs share) Even from the local network i couldn't access the client anymore. It seems to me there is some route missing, but i don't know.
I already tried a few other configuration changes but actually i have no clue what i'm missing.
Hope someone can show me what's wrong
Thx
