Hi guys,
I have tried to configure OpenVPN server with 2 IP pools. All logins/passwords are on RADIUS server. IP pool depends on group where is login.
1st pool managed by itself OpenVPN (10.0.0.0/11).
2nd pool managed by RADIUS server using Framed-IP-Address (10.16.0.0/11).
If user belongs to "group16" RADIUS sends Framed-IP-Address. If other group it doesn't send attr Framed-IP-Address and it must to be managed by OpenVPN server.
Framed-IP-Address doesn't work if option "client-config-dir" is not set. But on the other hand it creates ccd file and if user was deleted from "group16" it find existing ccd file and get last IP (which was given by RADIUS in Framed-IP-Address). So it can't assing IP from 10.0.0.0/11 network.
Please help to solve it!
server.conf:
topology subnet
client-config-dir ccd-files
local <server-ip>
dev tun
proto tcp
port 21
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
duplicate-cn
user nobody
group nogroup
server 10.6.0.0 255.255.0.0
persist-key
persist-tun
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
client-cert-not-required
username-as-common-name
keepalive 5 30
status /var/log/openvpn/status-tcp21.log 1
log-append /var/log/openvpn/server-tcp21.log
verb 6
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin-tcp21.cnf
management 127.0.0.1 5556
radiusplugin.cnf:
NAS-Identifier=OpenVpn
Service-Type=5
Framed-Protocol=1
NAS-Port-Type=5
NAS-IP-Address=<server-ip>
OpenVPNConfig=/etc/openvpn/server-tcp21.conf
subnet=255.224.0.0
overwriteccfiles=false
nonfatalaccounting=false
server
{
acctport=1813
authport=1812
name=radius-master.server.com
retry=5
wait=5
sharedsecret=xxxxxx
}
server
{
acctport=1813
authport=1812
name=radius-slave.server.com
retry=5
wait=5
sharedsecret=xxxxxx
}
Alex
