Sending Messages from client to Server

dkelb

Hi.

I need to send the remote IP that the client has connected to the Server.
I have 2 'remote' lines into my client.ovpn, and from the server I want to know where the connection entered.

With the management, I have not seen anything about it.

thanks in advance

janjust

the client does not send such info to the server; the server knows which IP it handed out to the client.

Check the status file or use the management interface to query the status of the VPN clients to see which certificate name (CN) is mapped to which IP.

dkelb

Hi janjust.

I need the 'remote' IP that the clients use to connect.
Not the end vpn IP.

CLIENT SIDE
The client.opvn config file have 2 lines 'remote' with two external IP to connect.

SERVER SIDE
I have 2 external IP, and want to know from wich IP this client connected.

Thanks.

janjust

use a 'client-connect' or 'learn-address' script - the env vars present within these scripts should contain all the right info. I often find it easiest to start out with a 'client-connect' script that simply echoes all env vars, e.g.

#!/bin/bash

env

this will print all output to wherever the server log is pointing.

dkelb

Okay.
The 'env' print all but not the 'remote' parameter from my client.ovpn.
So, i dont know from witch IP the connection established.

dkelb

If U or someone knows how to get this parameter from the client side, please tell me.

Thanks
Dennis

janjust

create the script with the 'env' in it, connect the client and post the output here - the info is all in there; it's either the 'trusted_remote_ip' or the 'untrusted_remote_ip' or something like that.

dkelb

The untrusted_remote_ip or trusted_remote_ip is a internal IP or the Valid IP from the Client.
But waht I need, is the IP that the client choose for establish the connection.
In the client side we have a conf, and a line saying 'remote xxx.xxx.xxx.xxx'.
I just need the value xxx.xxx.xxx.xxx.

janjust

you won't be able to get that info, as it is not fully reliable (due to NATting rules etc).
On the server side you should be able to see which IP was used to make the connection (by looking at 'netstat -an' and grepping for the remote client IP.

dkelb

But its a simple fixed LINE into the client configuration. doesnt matter if had a NAT rule...
'remote xxx.xxx.xxx.xxx'.

If the client send to the server, the line that it use to make this connect, its fine.
The Client must send this value to the connection/server.

Thanks in advance

janjust

not entirely true:
* the remote line may be a hostname which resolves to different IPs
* there might a NATting rule in place which translates the VPN server IP to something else.

I'm not saying this is the case for your setup, but whatever is specified in

remote xx.xx.xx.xx

should not be considered 'reliable'.

Your best bet it to check the connections on the openvpn server itself and match it against the remote_untrusted_ip.