[Solved] OpenVPN & Static IPs

GSnake

Hello, I'm trying to make my OpenVPN server assign static IPs to specific clients by their CN but no luck yet.
This is my server configuration:

# Which local IP address should OpenVPN
# listen on? (optional)
local 192.168.1.2

# Port listening on:
port 1194

# TCP or UDP server?
proto udp

dev tun

# Certs:

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key

# Diffie hellman parameters.

dh /etc/openvpn/dh2048.pem

# VPN Subnet:
server 10.2.1.0 255.255.255.0

# Static IPs:
ifconfig-pool-persist ipp.txt

# Client Custom Config Dir:
client-config-dir /etc/openvpn/ccd

# Tunneling traffic through VPN:
push "redirect-gateway"

# Push (Windows-Specific) DNS:
push "dhcp-option DNS 8.8.8.8"

# Clients will be able to contact each other:
client-to-client

# The Server will accept clients with the same certificate:
duplicate-cn

# Pings every 300 seconds and wait 900 seconds for a response (to keep alive the connection):
keepalive 300 900

# Compression:
comp-lzo

# Privilege downgrade: (Linux Specific)
user nobody
group nobody

persist-key
persist-tun

# Quick Log:
status openvpn-status.log

# Logs:
log         openvpn.log
log-append  openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

# Pushing Routes:
push "route 10.2.2.0 255.255.255.0"

I've already "chown"-ed the ccd folder to nobody:nogroup but still, no luck.
This is the content of one of the ccd/ files:

ifconfig-push 10.2.1.6 10.2.1.5

What am I doing wrong?
Thank you very much!

GSnake

I want my client to receive the same IP address each time it connects (obviously, I choose the address).

GSnake

Already done that. See the server config.

GSnake

As I said, the problem is that even if I set up the ccd folder with its user-client-name file in it, the ip that is set up in the user-client-name file is NOT reserved. After each logout -> login, the user receives a new IP (that SHOULDN'T HAPPEN!)

GSnake

I correctly created the certificates since in openvpn-status I see that my client has connected with the correct CN.

After 3 subsequent riconnections, this is the output. Notice how my client has got 3 different IPs even if I set the server to give him 10.2.1.6 each time.

Thu Oct 24 13:00:59 2013 X.X.X.X:49566 TLS: Initial packet from [AF_INET]X.X.X.X:49566, sid=55a24a83 252e4965
Thu Oct 24 13:01:00 2013 X.X.X.X:49566 VERIFY OK: depth=1, C=IT, ST=Milano, L=Milano, O=server, OU=server, CN=server, name=changeme, emailAddress=mail@host.domain
Thu Oct 24 13:01:00 2013 X.X.X.X:49566 VERIFY OK: depth=0, C=IT, ST=MI, L=Milano, O=Fort-Funston, OU=changeme, CN=user, name=changeme, emailAddress=mail@host.domain
Thu Oct 24 13:01:01 2013 X.X.X.X:49566 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 24 13:01:01 2013 X.X.X.X:49566 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 24 13:01:01 2013 X.X.X.X:49566 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 24 13:01:01 2013 X.X.X.X:49566 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 24 13:01:01 2013 X.X.X.X:49566 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Oct 24 13:01:01 2013 X.X.X.X:49566 [user] Peer Connection Initiated with [AF_INET]X.X.X.X:49566
Thu Oct 24 13:01:01 2013 user/X.X.X.X:49566 MULTI_sva: pool returned IPv4=10.2.1.6, IPv6=(Not enabled)
Thu Oct 24 13:01:01 2013 user/X.X.X.X:49566 MULTI: Learn: 10.2.1.6 -> user/X.X.X.X:49566
Thu Oct 24 13:01:01 2013 user/X.X.X.X:49566 MULTI: primary virtual IP for user/X.X.X.X:49566: 10.2.1.6
Thu Oct 24 13:01:03 2013 user/X.X.X.X:49566 PUSH: Received control message: 'PUSH_REQUEST'
Thu Oct 24 13:01:03 2013 user/X.X.X.X:49566 send_push_reply(): safe_cap=940
Thu Oct 24 13:01:03 2013 user/X.X.X.X:49566 SENT CONTROL [user]: 'PUSH_REPLY,redirect-gateway,dhcp-option DNS 8.8.8.8,route 10.2.2.0 255.255.255.0,route 10.2.1.1,topology net30,ping 300,ping-restart 900,ifconfig 10.2.1.6 10.2.1.5' (status=1)
Thu Oct 24 13:01:48 2013 X.X.X.X:53430 TLS: Initial packet from [AF_INET]X.X.X.X:53430, sid=b513f7bb d0e8b862
Thu Oct 24 13:01:48 2013 X.X.X.X:53430 VERIFY OK: depth=1, C=IT, ST=Milano, L=Milano, O=server, OU=server, CN=server, name=changeme, emailAddress=mail@host.domain
Thu Oct 24 13:01:48 2013 X.X.X.X:53430 VERIFY OK: depth=0, C=IT, ST=MI, L=Milano, O=Fort-Funston, OU=changeme, CN=user, name=changeme, emailAddress=mail@host.domain
Thu Oct 24 13:01:49 2013 X.X.X.X:53430 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 24 13:01:49 2013 X.X.X.X:53430 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 24 13:01:49 2013 X.X.X.X:53430 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 24 13:01:49 2013 X.X.X.X:53430 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 24 13:01:49 2013 X.X.X.X:53430 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Oct 24 13:01:49 2013 X.X.X.X:53430 [user] Peer Connection Initiated with [AF_INET]X.X.X.X:53430
Thu Oct 24 13:01:49 2013 user/X.X.X.X:53430 MULTI_sva: pool returned IPv4=10.2.1.10, IPv6=(Not enabled)
Thu Oct 24 13:01:49 2013 user/X.X.X.X:53430 MULTI: Learn: 10.2.1.10 -> user/X.X.X.X:53430
Thu Oct 24 13:01:49 2013 user/X.X.X.X:53430 MULTI: primary virtual IP for user/X.X.X.X:53430: 10.2.1.10
Thu Oct 24 13:01:51 2013 user/X.X.X.X:53430 PUSH: Received control message: 'PUSH_REQUEST'
Thu Oct 24 13:01:51 2013 user/X.X.X.X:53430 send_push_reply(): safe_cap=940
Thu Oct 24 13:01:51 2013 user/X.X.X.X:53430 SENT CONTROL [user]: 'PUSH_REPLY,redirect-gateway,dhcp-option DNS 8.8.8.8,route 10.2.2.0 255.255.255.0,route 10.2.1.1,topology net30,ping 300,ping-restart 900,ifconfig 10.2.1.10 10.2.1.9' (status=1)
Thu Oct 24 13:02:58 2013 X.X.X.X:58626 TLS: Initial packet from [AF_INET]X.X.X.X:58626, sid=9a538b10 5e578e03
Thu Oct 24 13:02:58 2013 X.X.X.X:58626 VERIFY OK: depth=1, C=IT, ST=Milano, L=Milano, O=server, OU=server, CN=server, name=changeme, emailAddress=mail@host.domain
Thu Oct 24 13:02:58 2013 X.X.X.X:58626 VERIFY OK: depth=0, C=IT, ST=MI, L=Milano, O=Fort-Funston, OU=changeme, CN=user, name=changeme, emailAddress=mail@host.domain
Thu Oct 24 13:02:59 2013 X.X.X.X:58626 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 24 13:02:59 2013 X.X.X.X:58626 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 24 13:02:59 2013 X.X.X.X:58626 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 24 13:02:59 2013 X.X.X.X:58626 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 24 13:02:59 2013 X.X.X.X:58626 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Oct 24 13:02:59 2013 X.X.X.X:58626 [user] Peer Connection Initiated with [AF_INET]X.X.X.X:58626
Thu Oct 24 13:02:59 2013 user/X.X.X.X:58626 MULTI_sva: pool returned IPv4=10.2.1.14, IPv6=(Not enabled)
Thu Oct 24 13:02:59 2013 user/X.X.X.X:58626 MULTI: Learn: 10.2.1.14 -> user/X.X.X.X:58626
Thu Oct 24 13:02:59 2013 user/X.X.X.X:58626 MULTI: primary virtual IP for user/X.X.X.X:58626: 10.2.1.14
Thu Oct 24 13:03:01 2013 user/X.X.X.X:58626 PUSH: Received control message: 'PUSH_REQUEST'
Thu Oct 24 13:03:01 2013 user/X.X.X.X:58626 send_push_reply(): safe_cap=940
Thu Oct 24 13:03:01 2013 user/X.X.X.X:58626 SENT CONTROL [user]: 'PUSH_REPLY,redirect-gateway,dhcp-option DNS 8.8.8.8,route 10.2.2.0 255.255.255.0,route 10.2.1.1,topology net30,ping 300,ping-restart 900,ifconfig 10.2.1.14 10.2.1.13' (status=1)

ccd/user:

ifconfig-push 10.2.1.6 10.2.1.5

GSnake

Fantastic! It works! 😃 (Never thought about that though!)
Thanks!