Hello all!
I'm sorry for my English. 🙂
I try to do something like described in howto:
https://openvpn.net/index.php/open-source/documentation/howto.html#policy
(Configuring client-specific rules and access policies)
I have ovpn server on Centos7 with white IP. Local address is 192.168.100.22/30.
I wont to have 2 groups of users: default, which have ip address in subnet 172.16.6.0/24 and custom, which have their own IP address from range 172.16.4.0/24.
So, this is my configs:
main config file:
# OpenVPN config
port 1194
proto tcp
dev tun
ca pki/ca.crt
cert pki/ovpn-server.crt
key pki/ovpn-server.key
crl-verify pki/vpn-crl.pem
dh pki/dh2048.pem
topology subnet
server 172.16.6.0 255.255.255.0
push "route 10.1.0.0 255.255.0.0"
client-config-dir ccd
route 172.16.4.0 255.255.255.0
push "dhcp-option DNS 10.1.1.2"
push "dhcp-option DNS 10.1.1.3"
keepalive 10 120
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
ccd file:
ifconfig-push 172.16.4.1 172.16.4.2
iroute 172.16.4.0 255.255.255.0
Client config file:
client
dev tun
proto tcp
remote XXXXXXXXXXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cryptoapicert "THUMB:<thumb>"
remote-cert-tls server
cipher AES-256-CBC
verb 2
But i have problem:
clients, which use main part of config (without ccd) - works fine. But clients, which I want to use custom paramets, won't works at all. There are no errors on server part, but on client:
Sat Jul 16 11:07:33 2016 us=389724 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.16.4.1/172.20.4.2 on interface {82FF6FFB-2F0C-4CCA-B012-5C51F4A46159} [DHCP-serv: 255.255.255.252, lease-time: 31536000]
Sat Jul 16 11:07:33 2016 us=389724 DHCP option string: 06080a07 01140a07 011e
Sat Jul 16 11:07:33 2016 us=389724 Successful ARP Flush on interface [20] {82FF6FFB-2F0C-4CCA-B012-5C51F4A46159}
Sat Jul 16 11:07:38 2016 us=553333 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sat Jul 16 11:07:38 2016 us=553333 Route: Waiting for TUN/TAP interface to come up...
.......
Sat Jul 16 11:08:09 2016 us=66986 C:\Windows\system32\route.exe ADD 10.1.0.0 MASK 255.255.0.0 172.16.6.1
Sat Jul 16 11:08:09 2016 us=66986 Warning: route gateway is not reachable on any active network adapters: 172.16.6.1
Sat Jul 16 11:08:09 2016 us=66986 Route addition via IPAPI failed [adaptive]
Sat Jul 16 11:08:09 2016 us=66986 Route addition fallback to route.exe
And I don't see any route like 172.16.4.1/30 on VPN Server.
Why openvpns server send to the custom client as a gateway-ip ip of servers' main subnet, not ip, which i push to the client in CCD file (172.16.4.2)?
Or what I'm doing wrong?
