I always get the same IP for the clients

Daimroc

I use easy-rsa to generate the certificates. First I create the ca.key, later I create the server.key and later for each client, I generate a new certificate, client01.key, client02.key... etc. One problem it's that for each client key that I generate, I need to delete and create a new index.txt file because I get and error updating the database.

Well, I use each certificate with each client, but I always get the same IP for all the clients, so in practice I only one client can be connected at the same time because exists a ip conflict.

I am using the version 2.3.2 (in know that have the security bug but I would like to solve this problem before generate all the certificates again):

My server config file is:

local 192.168.1.2
port 1194
proto udp
dev tun
dev-node OpenVPN
server 20.30.0.0 255.255.255.0

ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta-hmac.key 0

ifconfig-pool-persist ipp.txt

cipher AES-256-CBC #especifica el tipo decifrado que se utilizará para la comunicación


push "route 192.168.1.0 255.255.255.0"

push "dhcp-option WINS 20.30.0.1"
push "dhcp-option WINS 192.168.1.2"
tion DNS 20.30.0.1"

keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

And one of my clients (all use the same config, only change the certificate):

client
dev tun
dev-node TunnelTap
proto udp
remote x.x.x.x 1194


resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert client01.crt
key client01.key
tls-auth ta-hmac.key 1
ns-cert-type server


cipher AES-256-CBC

comp-lzo
verb 4
explicit-exit-notify 2
ping 10
ping-restart 60

route-method exe
route-delay 2

Why all the clients get the same ip?

Thank so much.

brendan

you always get the same IP because the identifying information that the DHCP instance uses (the info in the cert) is the same in all your certs.

you have to modify the vars file every time you want a new cert and the key lines to modify are:

export KEY_CN=""
export KEY_NAME=""

i put the short name (host) as the CN, and the FQDN (host.domain.tld) as the NAME. after you make those changes, source the vars file and run through the steps to create the cert. this creates unique info for the DHCP instance to key off of for IP assignment, and stops you from having to delete the index file as it will contain unique values for each of the certs created.

maikcat

One problem it's that for each client key that I generate, I need to delete and create a new index.txt file because I get and error updating the database.

:shock:

as others already suggested re-create your certs from scratch...

Michael.

Daimroc

Thanks.

The problem was the certs, I recreate them. OpenVPN use the common name (CN) to identify different clients and give different IP to clients that use certs with different CN. However when I create the certs for all the clients, I use the information that I set in the vars.bat file, so all the certs had the same CN. Now, when I create a new cert for a client I assign as CN the user name.

Thank so much.
Daimroc.