How to prevent client tun/IP spoofing? (to restrict NAT)

karma fusebox

Hello!

Please forgive me if this is not the right board to ask, the administration categories look quite similar to a newbie. 😃

I am running (say playing with) an OpenVPN server for several clients. I created certificates/private keys for each of them to log on the vpn. Using files in the client-config-dir I assign fixed IPs to them. Up to here, all this works just fine.

On the server I do this for NATting one specific client (my laptop) to the internet:

iptables -t nat -A POSTROUTING -s 10.8.0.42 -o eth0 -j MASQUERADE

My laptop (the .42 address) is routed out into the internet via eth0 and ANY other client is confined to the 10.8/16 vpn network without internet routing..

This works just fine as well.

However, I was able to simply change the IP address of the tun0 interface on one of the "unprivileged" clients to 10.8.0.42 and achieved full internet routing through the vpn server.

While googling about this problem, I read that it should not be possible to manually change the assigned tun0 address. But well, I did exactly that. Am I missing something or is there no simple way to get this out of the way?

Thanks a lot,
k-f

karma fusebox

Meanwhile I figured out that the obvious solution is to use a --learn-address script that manages iptables. (introducing problems with an unprivileged openvpn system user but thats another story).

Could somebody tell me where the server side timeout value for a disconnected clients is set? I set "keepalive" to "10 60" but the delete-Event in my learn-address script is triggered much later.