Cant Assign Client Static IP over routed VPN on Windows

jb

Unable to assign Static IP 10.0.0.185 to client.

- Server running on Windows 7 Pro
- Client running on Windows Server 2008 R2
- routed connection
- Server continues to assign client 10.0.0.6 despite the following settings:

#\cdd\client1
ifconfig-push 10.0.0.185 10.0.0.186

#server.ovpn
port 1194
proto udp
dev tun
dev-node tap0901
ca "c:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "c:\\Program Files\\OpenVPN\\config\\server.crt"
key "c:\\Program Files\\OpenVPN\\config\\server.key" # This file should be kept secret
dh dh1024.pem
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.0.0.184 255.255.255.0
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

I'm reading conflicting information online about the correct config settings. A few questions:
- Should \ccd\ client1 file use a subnet mask as the second IP entry?
- Does the static IP need to be outside the server subnet?
- What does the ipp.txt file do? Is this a factor/problem in assigning static IPs?
- How does the /30 subnet assigned to each client (Windows only?) affect assigning static IPs? I checked the --show-valid-subnets chart and x.x.x.185 is listed.

Feeling lost,
JB

jb

Yes, I am using the \ccd approach. 'ifconfig-pool-persist ipp.txt' has been commented out in the server config.

Following the instruction/comments embedded in the sample config files does not result in successful static IP assignment.

add to server config:

client-config-dir ccd
route 10.9.0.0 255.255.255.0

and create \ccd\client1 which contains:

ifconfig-push 10.9.0.1 10.9.0.2

-JB

jb

Client continues to receive next available IP from:

server 10.0.0.0 255.255.255.0

which puts client at 10.0.0.6.

Never seems to look at the \ccd client file. File name is an exact match to the client certificate. \ccd directory is correct.

I've tried changing the server subnet to 10.8.0.1 255.255.255.0 so that the \ccd client ifconfig-push IP is outside that subnet but still no luck.

-JB

jb

client \ccd file name: 'render'
X509 CN of client: 'render'

I tried the \ccd\default test and it doesn't read the 'ifconfig-push x.x.x.x x.x.x.x' from that either.

Could this be related- I'm using 'dev-node [tap adapter name]' in the server and client config even though routing. I read that Windows requires this and I know that I can't ping in either direction without it.

from the server log:

Fri Jan 10 20:29:09 2014 us=648261   ifconfig_pool_defined = ENABLED
Fri Jan 10 20:29:09 2014 us=648261   ifconfig_pool_start = 10.0.0.4
Fri Jan 10 20:29:09 2014 us=649261   ifconfig_pool_end = 10.0.0.251
Fri Jan 10 20:29:09 2014 us=650261   ifconfig_pool_netmask = 0.0.0.0
Fri Jan 10 20:29:09 2014 us=650261   ifconfig_pool_persist_filename = '[UNDEF]'
Fri Jan 10 20:29:09 2014 us=651261   ifconfig_pool_persist_refresh_freq = 600
Fri Jan 10 20:29:09 2014 us=652261   ifconfig_ipv6_pool_defined = DISABLED
Fri Jan 10 20:29:09 2014 us=652261   ifconfig_ipv6_pool_base = ::
Fri Jan 10 20:29:09 2014 us=653261   ifconfig_ipv6_pool_netbits = 0
Fri Jan 10 20:29:09 2014 us=654261   n_bcast_buf = 256
Fri Jan 10 20:29:09 2014 us=654261   tcp_queue_limit = 64
Fri Jan 10 20:29:09 2014 us=655261   real_hash_size = 256
Fri Jan 10 20:29:09 2014 us=656261   virtual_hash_size = 256
Fri Jan 10 20:29:09 2014 us=656261   client_connect_script = '[UNDEF]'
Fri Jan 10 20:29:09 2014 us=657261   learn_address_script = '[UNDEF]'
Fri Jan 10 20:29:09 2014 us=658261   client_disconnect_script = '[UNDEF]'
Fri Jan 10 20:29:09 2014 us=658261   client_config_dir = 'c:\Program Files\OpenV
PN\config\ccd\'
Fri Jan 10 20:29:09 2014 us=659261   ccd_exclusive = DISABLED
Fri Jan 10 20:29:09 2014 us=660261   tmp_dir = 'C:\Users\JONATH~1\AppData\Local\
Temp\'
Fri Jan 10 20:29:09 2014 us=661261   push_ifconfig_defined = DISABLED
Fri Jan 10 20:29:09 2014 us=662261   push_ifconfig_local = 0.0.0.0
Fri Jan 10 20:29:09 2014 us=662261   push_ifconfig_remote_netmask = 0.0.0.0
Fri Jan 10 20:29:09 2014 us=663262   push_ifconfig_ipv6_defined = DISABLED
Fri Jan 10 20:29:09 2014 us=664262   push_ifconfig_ipv6_local = ::/0
Fri Jan 10 20:29:09 2014 us=665262   push_ifconfig_ipv6_remote = ::
Fri Jan 10 20:29:09 2014 us=666262   enable_c2c = ENABLED
Fri Jan 10 20:29:09 2014 us=666262   duplicate_cn = ENABLED
Fri Jan 10 20:29:09 2014 us=667262   cf_max = 0
Fri Jan 10 20:29:09 2014 us=668262   cf_per = 0
Fri Jan 10 20:29:09 2014 us=669262   max_clients = 1024
Fri Jan 10 20:29:09 2014 us=669262   max_routes_per_client = 256
Fri Jan 10 20:29:09 2014 us=670262   auth_user_pass_verify_script = '[UNDEF]'
Fri Jan 10 20:29:09 2014 us=671262   auth_user_pass_verify_script_via_file = DIS
ABLED

I'm running out of ideas. Thanks for your help.

JB

jb

Yes, I have implemented the 10.0.0.186 10.0.0.185 values for 'ifconfig-push' that you called out earlier. Given these values, what IP and subnet should follow the 'route' function in the server config?

Yes, I understand that the CN is a value defined during the build-key process and not just the name of the certificate and key files.

To clarify, I rebuilt all certificates/keys as a troubleshooting measure, now using 'render' as the CN for the client certificate (as well as the \ccd config file name). There isn't a mismatch between 'client1' and 'render' from certificate to \ccd config file. Even if there was, the ccd\default file should have assigned the static IP.

Could it be a permissions issue with Windows not allowing the OpenVPN to read the \ccd files?

The client is on an Amazon EC2 instance. Could this be an issue?

JB