Hello,
I have an OpenVPN server on version `2.4.0-6+deb9u1` which has this configuration
server 10.110.0.0 255.255.0.0
. I set couple of static IP to some clients with the
ifconfig-push 10.110.0.30 10.110.0.31
line in the ccd folder. This works well.
Until today with a new dynamic client (OpenVPN 2.4.3) which connects and gets the same static IP as returned by the pool:
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_VER=2.4.0
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_PLAT=linux
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_PROTO=2
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_NCP=2
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_LZ4=1
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_LZ4v2=1 Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_LZO=1
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_COMP_STUB=1
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_COMP_STUBv2=1
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 peer info: IV_TCPNL=1
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Oct 18 14:58:25 2017 82.253.6.189:47230 [CLIENT_CN] Peer Connection Initiated with [AF_INET]82.253.6.189:47230
Wed Oct 18 14:58:25 2017 MULTI: new connection by client 'CLIENT_CN' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Wed Oct 18 14:58:25 2017 MULTI_sva: pool returned IPv4=10.110.0.30, IPv6=(Not enabled)
Wed Oct 18 14:58:25 2017 MULTI: Learn: 10.110.0.30 -> CLIENT_CN/82.253.6.189:47230
Wed Oct 18 14:58:25 2017 MULTI: primary virtual IP for CLIENT_CN/82.253.6.189:47230: 10.110.0.30
Wed Oct 18 14:58:26 2017 CLIENT_CN/82.253.6.189:47230 PUSH: Received control message: 'PUSH_REQUEST'
Why is this IP given to another client instead of only to the client in the ccd folder ?
The Serial Number of the certificate and the CN are totally different. I can avoid this problem with setting up another static ip for the other client, but shouldn't the IP already be taken by the other one?
Thank you
