ivanimp91
Hello everybody,
I'm trying configuring openvpn to interconnect some internal networks and I need to configure some different parameters for the clients, and I used the client-config-dir option. When I start the server and the clients it works perfectly and the clients have access to the internal network inside the vpn server. The problem is after some hours, the config files defined in the directory /etc/openvpn/ccd/ with all the parameters configured are rewritted deleting all the paremeters except the ifconfig-flush paremeter.
This is my server.conf configuration:
local 10.10.10.1
port 1194
proto udp
mode server
tls-server
topology subnet
ifconfig-pool 172.16.13.154 172.16.13.170 255.255.255.0
ca ca.crt
cert server.crt
key server.key
ifconfig 172.16.13.151 255.255.255.0
route 172.16.10.0 255.255.255.0 172.16.13.152
route 172.16.12.0 255.255.255.0 172.16.13.152
route 172.16.11.0 255.255.255.0 172.16.13.152
ifconfig-pool-persist ipp.txt
client-config-dir ccd
client-to-client
duplicate-cn
keepalive 10 120
persist-key
persist-tun
plugin /usr/lib/openvpn/radiusplugin.so radiusplugin.cnf
- The config file /etc/openvpn/ccd/ovpnclient1:
ifconfig-push 172.16.13.152 255.255.255.0
push "route 10.10.10.0 255.255.255.0 172.16.13.151"
iroute 172.16.10.0 255.255.255.0
iroute 172.16.12.0 255.255.255.0
iroute 172.16.11.0 255.255.255.0
- The config file /etc/openvpn/ccd/ovpnclient2:
push "route 10.10.10.0 255.255.255.0 172.16.13.151"
push "route-gateway 172.16.13.151"
push "route 172.16.10.0 255.255.255.0 172.16.13.151"
push "route 172.16.11.0 255.255.255.0 172.16.13.151"
push "dhcp-option DNS 10.10.10.10"
The ip addressing was changed for security reasons. After some hours the files /etc/openvpn/ccd/ovpnclient1 and /etc/openvpn/ccd/ovpnclient2 are changed with this content:
- /etc/openvpn/ccd/ovpnclient1:
ifconfig-push 172.16.13.152 172.16.13.153
- /etc/openvpn/ccd/ovpnclient2:
ifconfig-push 172.16.13.154 172.16.13.155
Anybody was found with the same problem ? Or I have any wrong configuration in my openvpn server?
Thanks for your help!!
janjust
openvpn itself does NOT rewrite anything inside the 'ccd' directory ; if files are rewritten 'automagically' then I'd be very worried about your VPN setup.
ivanimp91
Thanks for your reply janjust, in other configurations without using the client-config-dir option it creates a file in /etc/openvpn/ with the name of the CN of the client with the ifconfig-push directive, do you know if there are any option that can create this files? I'm thinking about using duplicate-cn it may be produces it, but i'm not sure.
janjust
the openvpn code itself does not produce such files; the radiusplugin, however (which I know very little about) might write out these files. Check the docs on the radius plugin.
ivanimp91
Yes! You have reason about it. The radius plugin was changed the client config files, I solved it deactivating this issue in the radius config file (overwriteccfiles=false), by default it's true. Thanks for your help!
