obtaining client ip from dns vs. pool

bartels

Hello Forum,

I would like openvpn server to obtain client address from the dns.
The pool can be a fallback when no dns entry is available.

This is behaviour that is normally seen in dhcp servers.

Is this possible, and if so, how do I tell openvpn which host name to use?

Sorry for asking this question again, but my previous attempt got answered with a question.

Thanks,
Bartels.

maikcat

maybe i am wrong but,

i know that DNS is for RESOLVING host names to ip addresses and vice versa

i know that DHCP (dynamic host configuration protocol) is for ASSIGNING
ip addresses to dhcp clients and keep a pool of which ips are in use,

also i know that DHCP protocol can contact and update DNS system (MS dhcp
in AD enviroment doit..)

what i dont understand (know maybe) is what exactly do you want to achieve?

if another mod can mention something different from the above is welcomed..

Michael.

bartels

Hello Michael,

Thanks for your reply. However we seem to have some confusion over terminology.
Maybe it is more clear if you explain.

When a client connects to the server, where does the client ip address come from?

bartels

maikcat

When a client connects to the server, where does the client ip address come from?

a client must connect to network first,means that client must obtain ip address (if you havent set it to static)
the protocol doing this is DHCP (Dynamic host configuration protocol),
the client (f.e your laptop) runs a dhcp client,dhcp server checks its pool , gives away one ip
and sometimes updates DNS (both reverse and forward lookup zones)..

dhcp is working with TCP/IP protocol suite...

after that when you want to connect to a server it depends of which protocol you want to use,
anyway after the ip handover the client is considered (at ip level) member of the network...

more info about dhcp you can visit wikipedia 😉

Michael.

bartels

Ok, thanks, Michael.

So the address comes from the pool and the server is free to update the dns.

Is it possible to do this the other way around: the ip address obtained from dns instead of the pool?

As background, this is how I run my dhcp servers: static ip addresses with authority in dns.

bartels

maikcat

As background, this is how I run my dhcp servers: static ip addresses with authority in dns.

can you explain it a little bit more...

dns is not monitoring which ips are in use and not,
dhcp can do that (and in MS enviroments with AD , you must AUTHORIZE the dhcp server)
by updating (if permissions on dns itself allow it) to delete & add records...

you can setup openvpn to use your internal dhcp btw...

Michael.

bartels

you can setup openvpn to use your internal dhcp btw...

Okay thanks, this sounds good.
How do I setup openvpn to use my dhcpd ?

bartels

maikcat

--ifconfig l rn
Set TUN/TAP adapter parameters. l is the IP address of the local VPN endpoint.
For TUN devices, rn is the IP address of the remote VPN endpoint. For TAP
devices, rn is the subnet mask of the virtual ethernet segment which is being cre‐
ated or connected to.

For TUN devices, which facilitate virtual point-to-point IP connections, the
proper usage of --ifconfig is to use two private IP addresses which are not a mem‐
ber of any existing subnet which is in use. The IP addresses may be consecutive
and should have their order reversed on the remote peer. After the VPN is estab‐
lished, by pinging rn, you will be pinging across the VPN.

For TAP devices, which provide the ability to create virtual ethernet segments,
--ifconfig is used to set an IP address and subnet mask just as a physical ether‐
net adapter would be similarly configured. If you are attempting to connect to a
remote ethernet bridge, the IP address and subnet should be set to values which
would be valid on the the bridged ethernet segment (note also that DHCP can be
used for the same purpose).

This option, while primarily a proxy for the ifconfig(8) command, is designed to
simplify TUN/TAP tunnel configuration by providing a standard interface to the
different ifconfig implementations on different platforms.

--ifconfig parameters which are IP addresses can also be specified as a DNS or
/etc/hosts file resolvable name.

For TAP devices, --ifconfig should not be used if the TAP interface will be get‐
ting an IP address lease from a DHCP server.

keep in mind that the dhcp thing only works by using openvpn in bridge mode.

regards

Michael.

bartels

Thanks, Michael.

I still don't see in your post what I should do to let the openvpn server use my dhcp server.
Is it a setting in the server.conf? If so, which one?

- bartels

maikcat

please post your server config to check if this setting can be applied to you..

Michael.

bartels

Okay, here it is:

dev tun
ca keys/ca.crt
cert server-keys/server.crt
key server-keys/server.key  
dh dh2048.pem
server 10.188.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
ccd-exclusive
client-config-dir ccd
keepalive 10 120
cipher BF-CBC        
comp-lzo
persist-key
persist-tun
status status.log
verb 2
crl-verify keys/crl.pem
tls-timeout 120

- bartels

maikcat

your config uses openvpn in routed mode

you cant give to your clients ips from your local subnet range,

using your lans dhcp cannot be applied to your setup

Michael.

bartels

your config uses openvpn in routed mode
you cant give to your clients ips from your local subnet range,

That makes perect sense. But I do not wish to give my clients ips from my local subnet range.

Quoting myself from an earlier post:

I have a small setup with perhaps 20 clients, all registered in a dns.
Everything runs fine, but I have one hickup: openvpn does not consult the dns when picking an ip address for a new client.

What I do now is populate ipp.txt from the dns before (re-)starting the openvpn server.

My question is only about configuring the openvpn server for dhcp/dns .

So how can this be done?

- bartels.