OpenVPN using 2 Public IP

iahr

Hi there,

Is there anyone can help me on how can I setup to use 2 Public IP on my server. Currently I have setup OpenVPN and authentication is via Freeradius (daloradius) and it is working fine using 1 public IP. What I want to do is to use my another Public IP on my server. But I don't know how to set specific user to use the specific public IP. I tried to follow the steps on this link ( https://forums.openvpn.net/topic8559.html ) but no luck for me. I think that my CCD wont read if user is connecting, users still getting dhcp IP instead of IP I assign.

Heres my config on server.conf

;local a.b.c.d
port 1194
proto udp
dev tun
ca ca.crt
cert myserver.crt
key myserver.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
persist-key
persist-tun
#Username and password authentication ---- I use plugin to authenticate users on freeradius
client-cert-not-required
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
status openvpn-status.log
verb 3
client-config-dir /etc/openvpn/ccd
route 10.8.2.0 255.255.255.0

/etc/openvpn/ccd/username1
ifconfig-push 10.8.2.9 10.8.2.10

iptables -A FORWARD -s 10.8.1.0/24 -j ACCEPT
iptables -A FORWARD -s 10.8.2.0/24 -j ACCEPT

But my username1 still getting 10.8.0.x instead of 10.8.2.x that I assign. I think I need first to make it work first to assign users local IP address. Then I need to NAT local IP to public IP.

Thanks for you can help me with this.

Traffic

First;

iahr wroteHeres my config on server.conf

server 10.8.0.0 255.255.255.0

Clients must be assigned IP address from the same subnet, so this:

iahr wrote/etc/openvpn/ccd/username1
ifconfig-push 10.8.2.9 10.8.2.10

is the wrong subnet.

iahr wroteThen I need to NAT local IP to public IP

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

assuming eth0 is your server LAN NIC and masquerading is supported.

This may be more suitable:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source {public.ip.address}

iahr

Thanks for the reply Traffic. 😉

Traffic: "Clients must be assigned IP address from the same subnet"

- I assigned IP on other IP segment for them to easily identified which segment is using other public IP. That's why I also put
iptables -A FORWARD -s 10.8.1.0/24 -j ACCEPT >>> correction typo error this is 10.8.0.0/24
iptables -A FORWARD -s 10.8.2.0/24 -j ACCEPT
to be forwarded.

Also I tried to before to assign on CCD on same segment of 10.8.0.0.x but no luck to get the user the static IP I assign.
/etc/openvpn/ccd/username1
ifconfig-push 10.8.0.9 10.8.0.10

I dont know whats wrong why users I assign on ccd not reading to assign static ip. it always getting the dhcp ip of 10.8.0.x
I am not sure if I need this configure on my Freeradius since it is the one who authenticate the users. Hope you can help me with this.
I am focus for now on how to assign ip address of my users.

Thanks in advance.

iahr

Traffic

I suggest you post your complete server and client logs at verb 4
You can remove your publicly identifiable IP addresses etc.