openvpn client overriding IP address

vieri

Hi,

On the server I'm setting static IP addresses with the client-config-dir option (ifconfig-push).
Then I define iptables access rules based on these static IP addresses. So I *require* the client not to be able to change its virtual IP address.

Is there any way the client could override "ifconfig-push" from the server?

Let's suppose I have this on the server: [...]
mode server
tls-server
topology subnet
push "topology subnet"
ifconfig 192.168.148.1 255.255.252.0
ifconfig-pool 192.168.148.2 192.168.148.254 255.255.252.0
push "route-gateway 192.168.148.1"
route-gateway 192.168.148.2
client-config-dir /etc/openvpn/ccd
[...] ifconfig-push 192.168.151.48 255.255.252.0 I do not want openvpn CLIENT1 to somehow change its virtual IP address. I want it to either have 192.168.151.48 or not communicate at all with my openvpn server.

Is this already the case?

As a side question, what if by any chance the remote client, before launching the openvpn application, has an ethernet interface with the IP address 192.168.151.48 (same as the one defined in the openvpn server's client-config-dir) but maybe a different gateway. Will it be able to connect or will the openvpn client fail?
Also, what if the client NIC's IP address is set to (locally assigned), eg., 192.168.151.49 before connecting with openvpn (IP address is within the configured range on the server), will the openvpn client fail to connect to the server?
Basically, I'm OK if the client fails. I just want to make sure that the IP addresses the openvpn server pushes out to the clients are untouchable (either dynamic pool or static ones from ccd). That's because the iptables firewall rules rely on "source" IP addresses.

Thanks

TinCanTech

vieri wroteIs there any way the client could override "ifconfig-push" from the server?

Yes !

vieri wrote do not want openvpn CLIENT1 to somehow change its virtual IP address. I want it to either have 192.168.151.48 or not communicate at all with my openvpn server.

Is this already the case?

Yes .. if the client changes it's IP address without consent from the server then the server will drop any incoming packets recieved over the VPN, like so:

MULTI: Bad source address from client [192.168.151.248], packet dropped

where 192.168.151.248 is not the IP address pushed to the client.

vieri wrotewhat if by any chance the remote client, before launching the openvpn application, has an ethernet interface with the IP address 192.168.151.48 (same as the one defined in the openvpn server's client-config-dir)

Then you have a network conflict, which you will have to resolve.