tewues
Hello.
OpenVPN-2.2.1 server running on Debian Wheez-7.5.0...
Just wondering, whether it is possible to assign a poll
of sixteen IP's (or more) to one client machine (IP)?
net30 option - assigns 4 IP's but only 1 is usable
subnet option - assigns single IP only
Best regards.
Tom
tewues
Hello debbie10t
Many thanks for your answer...
If "Not by using openvpn", then how, please?
But still would like to have VPN functionality.
Best regards.
Tom
tewues
Hello debbie10t et al.
Today after some tests performed I have an answer to my own question.
Very brief answer is:
YES, it is possible to assign subnet to a particular VPN client!
Commands giving such nice possibility (example):
- in the OpenVPN server config file
topology subnet
route 10.165.15.16 255.255.255.240
- in the OpenVPN client config file (on server!!!)
ifconfig-push 10.165.15.17 255.255.255.0
iroute 10.165.15.16 255.255.255.240
Already allocated subnets may appear and will be
reachable EXCLUSIVELY on previously assigned machines.
All other addresses may emerge anywhere.
Refer to OpenVPN ManPage:
--iroute network [netmask]
Generate an internal route to a specific client. The netmask parameter,
if omitted, defaults to 255.255.255.255.
This directive can be used to route a fixed subnet from the server to a particular
client, regardless of where the client is connecting from. Remember that you must
also add the route to the system routing table as well (such as by using the
--route directive). The reason why two routes are needed is that the --route
directive routes the packet from the kernel to OpenVPN. Once in OpenVPN,
the --iroute directive routes to the specific client.
This option must be specified either in a client instance config file using
--client-config-dir or dynamically generated using a --client-connect script.
The --iroute directive also has an important interaction with --push "route ...".
--iroute essentially defines a subnet which is owned by a particular client
(we will call this client A). If you would like other clients to be able to reach A's
subnet, you can use --push "route ..." together with --client-to-client to effect
this. In order for all clients to see A's subnet, OpenVPN must push this route
to all clients EXCEPT for A, since the subnet is already owned by A. OpenVPN
accomplishes this by not not pushing a route to a client if it matches one
of the client's iroutes.
Best regards.
Tom
tewues
Hello Traffic.
Just due to different wording I didn't found earlier right solution.
Anyway, thank you very much for really interesting link.
Best regards.
Tom
