Hi All,
I have a bit of a quandry, and I was wondering if anyone could offer some advice.
I'm running an OpenVPN server on an Amazon EC2 instance (Windows) and it's working fine as it is. I have a local client here in my office, which has its own cert. They can chat to each other with no problem, both ways, all lovely. My problem is that I need to spawn potentially up to 100 other instances which all connect to the VPN on EC2. Everything about their setup needs to be entirely automated.
Right now, they all share a cert key - which is DIFFERENT to my local client's. They have to, as far as I'm aware, because they are all spawned from the same "image", as it were. This is fine - they can all connect and all get a legitimate IPs and talk over the network. So that's all working fine too.
So what's the problem? Well, my local client needs to use a specific IP. In fact, it actually doesn't matter what that IP is, but it needs to be static, always the same. There are a few options here, but none of them have worked for me:
- Using ipp.txt to have the IP's of machines doesn't work. It actually ends up with a totally blank ipp.txt file, which I think may be due to duplicate-cn being active. Even if it were "working", though, it's done on a per-cert basis, so all of my spawned instances would have the same IP which won't work for my purposes.
- If I used a custom config file in the ccd file for my local client that needs the static IP address, this works - it gets the correct IP address. However, then the first of my spawned instances always takes that same address. (Note that the address in question is 100.8.0.6 - in other words, it's the first available address. The second will take x.x.x.10, the next x.x.x.14 etc). Once this happens, all communications to that IP address go to whichever machine acquired it most recently. The OpenVPN log changes to show that the last machine to connect is active on that IP, and any previous ones that had it are no present in the log.
So in other words, I need a system that enables me to both simultaneously allow multiple machines to connect using the same cert, but also allows a specific machine (which DOES have its own cert) to have exclusive use of a given IP. The spawned machines need to be able to talk to my local client (which is working at the moment thanks to "client-to-client". It then ceases to work when another machines takes that IP.)
One "solution" I can think of would be to give my local client the IP that's furthest from 0, so as to reduce the chances of it being taken by another machine. But that's hardly elegant...
My server config is below:
push "route 0.0.0.0 255.255.255.255 net_gateway"
port 1194
proto udp
dev tun
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\server.key" # This file should be kept secret
dh "C:\\Program Files (x86)\\OpenVPN\\config\\dh1024.pem"
server 100.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 100.8.0.0 255.255.255.252
client-to-client
duplicate-cn
keepalive 10 20
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
