sandro Hi all, one of my openvpn systems runs in "server-bridge"- mode serving a couple of openvpn clients. In "peers.txt" i defined the tunnel IPs of that clients depending on their certificate CN (i.e. "vpn-client-1 10.0.1.10". So the multiple clients get fixed tunnel IP when connecting to that central server. This i needed to identify clients and route several Layer3 networks behind these (distinguishable) clients. I see a weired behavior occuring randomly: sometimes a client reconnects and gets a different IP from that previous setting in peers.txt. AND a line was added automaticaly (!) to peers.txt on that client's CN and this new IP. My own line remains in peers.txt, but the new line comes first and gets evaluated now on. What triggers such behaviour, why does openvpn adds a line itself to peers.txt and how can i avoid this? Thanks, Sandro.
janjust without config files it's hard to tell what is going on; my guestimate is that your server config includes a line ifconfig-pool-persist ..../peers.txt
sandro The config is quite simple and contains the "ifconfig-pool-persist" option already: --- local a.b.c.d dev tap port 5000 proto udp server-bridge 10.0.1.1 255.255.255.0 10.0.1.10 10.0.1.199 ifconfig-pool-persist /etc/openvpn/peers.txt client-to-client keepalive 10 120
janjust and that is EXACTLY why the peers.txt file is updated - it's normal openvpn behaviour. You can overrule this behaviour by adding the parameter '0' behind it: ifconfig-pool-persist /etc/openvpn/peers.txt 0
sandro Yes, that option surely was missed to switch the file in true read-only status. Thanks! But this question is still interesting for me: why does openvpn add another line regarding the *same* DN i.e. "vpn-client-abc 10.0.1.x" when a line "vpn-client-abc ..." already exists within that file? In some cases i might want to use the feature on dynamic ips of formerly unknown clients but wish absolute-stable IPs for predefined ones. Thanks, Sandro.
janjust I don't know the definitive answer to your last question, but I'd recommend to NOT use the ifconfig-pool-persist file for that - it'd be better to use a client-connect script.
sandro OK. Just imagine: on the server side i want to deploy firewall rules depending on the client IP. That shouldnt depend on a script on the client to choose its IP... When the ifconfig-pool-persist directive get the "0" option - will unlisted clients allowed to get connected/ get an IP actually? Sandro.
janjust unlisted clients will get a random IP , and as long as the server is not restarted then unlisted clients will even be assigned the same IP between reconnects, but there's no guarantee for that. They WILL be able to connect, however.
sandro insofar last question: is it possible to limit clients connections to only listed clients, even when other clients have valid certificates but should not be allowed to connect/ should get IPs from a different pool or other? Thanks, Sandro.
janjust yes that's all possible but you'll need 'client-connect' and/or 'tls-verify' scripts to do so.
