Hello, It there any possibilities that we provide public IPs to each session using TUN? please advise. Regards, Jebran.

hi there, you can assign any ip you want... the problem though is that public ips are routed by internet routers, you cant simply assign a public ip to your vpn and expect that the world will know how to route traffic back to you....(except you are an ISP :) ) there is a reason why they called "public"... ;) Michael.

Hi Michael, Thanks for reply, IPs which I want to assign VPN client are already set in router to pass traffic, I have tested this to provide our IP range through "tap bridge" method, it was working great. But now want to do the same thing through "tun" please advise. Regards, Jebran.

tun uses routing only, if you setup your routing accordingly then it will work... Michael.

ok, if I setup routing properly so, what server directive I can use? I have 125 public IPs (xxx.47.229.129 to xxx.47.229.255 ) linked with OpenVPN server I want so assign 30 of them so server directive should be server xxx.47.229.224 255.255.255.224 ? Kindly advise. Regards, Jebran.

yes and you will lose 2 (network & broadcast)... i suggest you also use mode subnet instead of p2p Michael.

Yes defiantly I don't want to lose any IP from public pool. what is mode subnet how can I use? Regards, Jebran.

[quote]--topology mode Configure virtual addressing topology when running in --dev tun mode. This direc‐ tive has no meaning in --dev tap mode, which always uses a subnet topology. If you set this directive on the server, the --server and --server-bridge direc‐ tives will automatically push your chosen topology setting to clients as well. This directive can also be manually pushed to clients. Like the --dev directive, this directive must always be compatible between client and server. mode can be one of: net30 -- Use a point-to-point topology, by allocating one /30 subnet per client. This is designed to allow point-to-point semantics when some or all of the con‐ necting clients might be Windows systems. This is the default on OpenVPN 2.0. p2p -- Use a point-to-point topology where the remote endpoint of the client's tun interface always points to the local endpoint of the server's tun interface. This mode allocates a single IP address per connecting client. Only use when none of the connecting clients are Windows systems. This mode is functionally equivalent to the --ifconfig-pool-linear directive which is available in OpenVPN 2.0 and is now deprecated. [b][u]subnet[/b][/u] -- Use a subnet rather than a point-to-point topology by configuring the tun interface with a local IP address and subnet mask, similar to the topology used in --dev tap and ethernet bridging mode. This mode allocates a single IP address per connecting client and works on Windows as well. Only available when server and clients are OpenVPN 2.1 or higher, or OpenVPN 2.0.x which has been man‐ ually patched with the --topology directive code. When used on Windows, requires version 8.2 or higher of the TAP-Win32 driver. When used on *nix, requires that the tun driver supports an ifconfig(8) command which sets a subnet instead of a remote endpoint IP address.[/quote] you can assing ips like in tap mode... Michael.

Hello Michael, Thanks for the document, I have configure the server as documented understanding still getting some errors kindly note given below details. {server config} [code]mode server tls-server port 80 dev tun topology subnet client-cert-not-required username-as-common-name ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\server.crt" key "C:\\Program Files\\OpenVPN\\config\\server.key" # This file should be kept secret dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem" ifconfig 10.2.13.1 10.2.13.10 push "redirect-gateway def1 bypass-dhcp" cipher AES-256-CBC push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 8.8.4.4" duplicate-cn keepalive 10 120 tls-auth ta.key 0 # This file is secret comp-lzo persist-key persist-tun status openvpn-status.log log-append openvpn.log verb 3 mute 20 route-method exe script-security 3 auth-user-pass-verify "C:/php/php.exe C:/scripts/ldap.php" via-file [/code] {client config} [code] client dev tun proto tcp remote xx.xx.229.130 80 nobind persist-key persist-tun ca ca.crt tls-auth ta.key 1 cipher AES-256-CBC comp-lzo verb 3 mute 20 route-method exe route-delay 2 auth-user-pass login.conf reneg-sec 0 tun-mtu 1500 mssfix 1450 [/code] [b]Getting error at client side logs please advise. [/b] [quote]Wed Feb 06 16:28:11 2013 SENT CONTROL [Server]: 'PUSH_REQUEST' (status=1) Wed Feb 06 16:28:11 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 8.8.4.4,ping 10,ping-restart 120' Wed Feb 06 16:28:11 2013 OPTIONS IMPORT: timers and/or timeouts modified Wed Feb 06 16:28:11 2013 OPTIONS IMPORT: route options modified Wed Feb 06 16:28:11 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Wed Feb 06 16:28:11 2013 ROUTE default_gateway=192.168.20.1 Wed Feb 06 16:28:11 2013 TAP-WIN32 device [Open connection] opened: \\.\Global\{9D9D0336-1476-4B02-A401-5C59FEFE2449}.tap Wed Feb 06 16:28:11 2013 TAP-Win32 Driver Version 9.6 Wed Feb 06 16:28:11 2013 TAP-Win32 MTU=1500 Wed Feb 06 16:28:11 2013 ERROR: --dev tun also requires --ifconfig Wed Feb 06 16:28:11 2013 Exiting [/quote]

please edit your server config to: [quote] tls-server port 80 proto tcp-server dev tun topology subnet client-cert-not-required username-as-common-name ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\server.crt" key "C:\\Program Files\\OpenVPN\\config\\server.key" # This file should be kept secret dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem" server 10.2.13.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp" cipher AES-256-CBC push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 8.8.4.4" duplicate-cn keepalive 10 120 tls-auth ta.key 0 # This file is secret comp-lzo persist-key persist-tun status openvpn-status.log log-append openvpn.log verb 3 mute 20 route-method exe script-security 3 auth-user-pass-verify "C:/php/php.exe C:/scripts/ldap.php" via-file [/quote]

Dear Michael, As per you advise I have edit conf file but service could not starting given below error one by one. [quote]Options error: --duplicate-cn requires --mode server[/quote] [quote]Options error: --client-cert-not-required requires --mode server[/quote] [quote]Options error: --username-as-common-name requires --mode server[/quote] [quote]Options error: --auth-user-pass-verify requires --mode server[/quote] Regards, Jebran.

TUN can assign public IPs?

imjebran

Hello Michael,

How are you,

details are:-

Server OS win 2008 R2 server, have one ethernet connection connected directed WAN router, I have 125 public IP pool linked with this server, "means I can add any public IP(s) from this pool on enternet connected and I will be work"

I have installed OpenVPN then I configure OpenVPN give all necessary options as per my requirement, and give a 30 IPs pool which assigned to OpenVPN client, these 30 IPs are part of 125 IP pool linked with this server.

I have dial from client to the server, openVPN server give to the client an IP from 30 IP which I configured for incoming VPN connection, after connection established no internet activity on client end, to diagnose this issue I have take several steps are were useless, but when I add the IP(which assigned to openVPN client) on server enternet and remove it within few seconds Internet will be active on client end at same time outgoing through same IP which assigned to client, it is strange behavior,

I have dial on more session of OpenVPN from different client machine OpenVPN server assigned one more IP from 30 IP pool, same as previous internet was not active, I again do same thing add this IP on server ethernet and remove it within few seconds, internet start working for this client too.

these all IPs are Public IPs.
Please advise.

Jebran.

maikcat

can you post the latest configs used?

to give out ips used in your lan you must setup openvpn in bridge mode,
which needs special attention not breaking your clients routing table.

using real ips and tun interface means that you must break your subnet accordingly
for routing to work...

another approach is to hand out private ips and perform 1-to-1 NAT on your openvpn server...

please repost your latest configs used to get a picture of your current setup..

Michael.

imjebran

I already checked bridge mode do configure my OS interfaces bridging it will be working fine each client get Public ip and internet was working but as you know bridge-mode configure on TAP 🙁 .

You are right I can use one-to-one NAT, But our priority is provide public IP directly to each client with TUN.

Config file is below.

tls-server
port 80
proto tcp-server
dev tun
topology subnet
client-cert-not-required
username-as-common-name

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"  # This file should be kept secret
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"

server xx.xx.229.224 255.255.255.224
;server 10.13.1.224 255.255.255.224

push "redirect-gateway def1"

;server-bridge xx.xx.229.225 255.255.255.224 xx.xx.229.226 xx.xx.229.254

cipher AES-256-CBC

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.4.4"

duplicate-cn
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3
management localhost 7505
mute 20
route-method exe
script-security 3
auth-user-pass-verify "C:/xxx.exe C:/xxx/xxx.php" via-file

maikcat

ok then

i assume that your openvpn servers lan ip is configured correcty...

your internet router also needs to be configured for routing correctly packets
destined from openvpn subnet to your opencpn server...

did you configured your internet router too?

Michael.

imjebran

Hello,

Openvpn servers lan ip is configured correctly,

your internet router also needs to be configured for routing correctly packets
destined from openvpn subnet to your opencpn server...

I have not put any additional routes on internet route, because route already configure to destined whole subnet to openVPN server.

do you thing we need to add some addition configuration on router side if I break the subnet?

Regards,
Jebran.

maikcat

I have not put any additional routes on internet route, because route already configure to destined whole subnet to openVPN server.

in that case your router will try to use its ethernet interface for ips that are over openvpn....

you should use the same netmask as your openvpn server uses and create a static route
for the ips given to your openvpn clients...

you do configured routing correctly right? 8-)

Michael.

imjebran

Hello Michael,

That is good point, I have inform our data center Network Administrator about it, and force them to add such static router separately for OpenVPN.

I will confirm you once we response from Network administrator, thanks for your support 🙂

Regards,
Jebran.

imjebran

Hello Michael,

How are you?

You were right 8-)

It is working after putting route on router side.

Only one thing which hesitating me that openVPN server always taking first IP from the subnet however the first IP of every subnet will use as gateway at router side.

it is possible that we force OpenVPN server to take second IP?

Regards,
Jebran.

maikcat

hello jebran,

You were right 8-)

i am always right 😃 and i am humble too 🙂

Only one thing which hesitating me that openVPN server always taking first IP from the subnet however the first IP of every subnet will use as gateway at router side.

i dont quite understand that....
openvpn takes the first ip derived from the subnet mask given in server directive.....

can you please post the server directive used (the mask portion) and write what ip openvpn gets?

Michael.

imjebran

Hi,

i am humble too 🙂

hahahaha,

can you please post the server directive used (the mask portion)

server xxx.145.50.0 255.255.255.0

write what ip openvpn gets

IP: xxx.145.50.1 Netmask 255.255.255.0

As you know I am using public IP pool so xxx.145.50.1 already configured at router side as gateway.
please advise.
Jebran.

maikcat

IP: xxx.145.50.1 Netmask 255.255.255.0

As you know I am using public IP pool so xxx.145.50.1 already configured at router side as gateway.
please advise.

unfortunately you have to divide your subnet....

how good is your subneting skills? 🙂

the downside is that you will lose some ips on the way....
your problem is purely ip subnetting...

regards
Michael.

imjebran

unfortunately you have to divide your subnet....

So If i divide my subnet IP: xxx.145.50.128 Netmask 255.255.255.128
OpenVPN server will take xxx.145.50.129 rest xxx.145.50.130 to xxx.145.50.254 for incoming VPN client.
problem is again that IP xxx.145.50.129 is gateway of this subnet am i right.

how good is your subneting skills? 🙂

I don't know 🙂

the downside is that you will lose some ips on the way

no issue if I lose few IPs. 🙂

maikcat

So If i divide my subnet IP: xxx.145.50.128 Netmask 255.255.255.128
OpenVPN server will take xxx.145.50.129 rest xxx.145.50.130 to xxx.145.50.254 for incoming VPN client.
problem is again that IP xxx.145.50.129 is gateway of this subnet am i right.

yes you are,
yes you need ip address re-assignment also 🙂

I don't know 🙂

i guess its time you will find out 🙂

no issue if I lose few IPs. 🙂

it depends of the number of subnets you intend to create,
using .128 mask you only lose extra 2 ips....
the problem is that you are assinging 126 ips to your clients,
if you want to assign 30 (+2) you need to brake your range by 8 (32*8)
meaning that you will loose 8*2 16 ips along the way... 🙁

Michael.

[deleted]

Have your provider give you a /30 and route the /25 to it. No IP's lost then

imjebran

Hi Michael, Douglas,

Thanks for advise, I have provided static route information to our provider.

I will update you once they done it.

Regards,
Jebran.

imjebran

Hello Michael,

I want to say thanks to you for understanding my case. 🙂

As I open this case name "TUN can assign public IPs?" answer is YES.

It is working fine I have configure OpenVPN on windows server OS it is working, after putting static routes for subnet which assigned by OpenVPN on our router side.

Regards,
Jebran.

maikcat

t is working fine I have configure OpenVPN on windows server OS it is working

glad to know that things worked out for you...

closing topic.

Best regards

Michael.

« Previous Page