Setting fixed-IP to VPN clients in a OpenVPN VPS install

ionut

Hello, after I've went through the forum and didn't really find something that deals with my situation I've decided that it's better to ask for help. I'm not quite a total beginner in networking but Linux is not my strong point. Some context on my setup, at a remote country house I have setup 4 android phones that run IPWebcam Pro for surveilance, all phones are connected to a wireless router and have installed additionally AutomateIT Pro that deals with - scheduled reboots (IPWebcam tends to freeze from time to time), cloud upload of recorded motion detection and delete them after upload etc. I also have TeamViewer Host Control for remote control, the thing is until recently I used a service built within IPwebcam app for cloud streaming, Ivideon, but they have increased subscription costs and now I ended up paying 10EUR per month with no storage feature, just remote streaming for the 4 devices. I needed to use Ivideon because my internet provider uses CG-NAT and I can't forward any IP or port. Since i was motivated on finding a solution for this issue I ended up setting an OpenVPN and Zoneminder server on a Debian VPS with public static IP at arubacloud for 1EUR/month, all my phones/cameras connect directly to that server through OpenVPN for android and everything works great but I still have 2 issues for which i need help:

1) Every time my camera restart and connect to the OpenVPN server it receives a different IP, that means Tinycam Monitor or other NVR software on my phone or pc can't access them until I modify the connection with the new IP, so to solve this I need help setting them static or fixed IP every time. Also to access them my phone or PC need to be connected to my VPN and this lead to the next issue
2) Zoneminder NVR server is installed on the same server as my OpenVPN, I have successfully configured it so it can be accessed through the VPS IP and port in a standard browser without VPN. The problem is I can't add my cameras to Zoneminder because they are on a different subnet, the one that the VPN connection creates.

To install OpenVPN I used a road warrior installation script form: https://github.com/Nyr/openvpn-install

My server config is:

[oconf=]
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 62.149.128.4"
push "dhcp-option DNS 62.149.132.4"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
duplicate-cn
client-to-client
[/oconf]

One of my client config is:
[oconf=]
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote serverIP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>
-----BEGIN CERTIFICATE-----
Certificate
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
51:c5:c0:bd:e0:c1:28:2e:43:34:11:e6:3d:92:ce:02
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=ChangeMe
Validity
Not Before: Mar 25 06:54:22 2018 GMT
Not After : Mar 22 06:54:22 2028 GMT
Subject: CN=lenovopc
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:Public Key
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
79:C6:59:8E:EA:43:4D:61:C6:B8:E8:2A:96:84:1B:65:AE:C8:6F:B2
X509v3 Authority Key Identifier:
keyid:96:91:03:53:61:6C:A2:E0:F3:EE:1D:24:58:35:7D:67:05:EA:FA:AD
DirName:/CN=ChangeMe
serial:F2:D6:CB:75:C2:4C:56:36

X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: TLS
-----BEGIN CERTIFICATE-----
Certificate
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
Privatekey
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
Static Key
-----END OpenVPN Static key V1-----
</tls-auth>
[/oconf]

TinCanTech

ionut wrote I need help setting them static or fixed IP every time

You need a CCD file for each of your clients.

See --client-config-dir in The Manual v24x

ionut

Thanks for prompt response, I've tried client config following this tutorial http://dnaeon.github.io/static-ip-addresses-in-openvpn/ , but I don't have any connection after I set everything up. My CCD file is called lenovopc and contains this line: ifconfig-push 10.8.0.10 10.8.0.1 the file has access granted with 777 so is the folder. I have an error:

Wed Mar 28 15:01:55 2018 OpenVPN 2.3.18 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct 26 2017
Wed Mar 28 15:01:55 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Wed Mar 28 15:01:55 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Wed Mar 28 15:01:55 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Mar 28 15:01:55 2018 Need hold release from management interface, waiting...
Wed Mar 28 15:01:55 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Mar 28 15:01:55 2018 MANAGEMENT: CMD 'state on'
Wed Mar 28 15:01:55 2018 MANAGEMENT: CMD 'log all on'
Wed Mar 28 15:01:55 2018 MANAGEMENT: CMD 'hold off'
Wed Mar 28 15:01:55 2018 MANAGEMENT: CMD 'hold release'
Wed Mar 28 15:01:55 2018 Control Channel Authentication: tls-auth using INLINE static key file
Wed Mar 28 15:01:55 2018 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 28 15:01:55 2018 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 28 15:01:55 2018 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Mar 28 15:01:55 2018 UDPv4 link local: [undef]
Wed Mar 28 15:01:55 2018 UDPv4 link remote: [AF_INET]80.211.0.39:1194
Wed Mar 28 15:01:55 2018 MANAGEMENT: >STATE:1522238515,WAIT,,,
Wed Mar 28 15:01:55 2018 MANAGEMENT: >STATE:1522238515,AUTH,,,
Wed Mar 28 15:01:55 2018 TLS: Initial packet from [AF_INET]80.211.0.39:1194, sid=663ec38a 91f5815b
Wed Mar 28 15:01:56 2018 VERIFY OK: depth=1, CN=ChangeMe
Wed Mar 28 15:01:56 2018 Validating certificate key usage
Wed Mar 28 15:01:56 2018 ++ Certificate has key usage 00a0, expects 00a0
Wed Mar 28 15:01:56 2018 VERIFY KU OK
Wed Mar 28 15:01:56 2018 Validating certificate extended key usage
Wed Mar 28 15:01:56 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Mar 28 15:01:56 2018 VERIFY EKU OK
Wed Mar 28 15:01:56 2018 VERIFY OK: depth=0, CN=server
Wed Mar 28 15:01:56 2018 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Mar 28 15:01:56 2018 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 28 15:01:56 2018 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Mar 28 15:01:56 2018 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 28 15:01:56 2018 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Mar 28 15:01:56 2018 [server] Peer Connection Initiated with [AF_INET]80.211.0.39:1194
Wed Mar 28 15:01:57 2018 MANAGEMENT: >STATE:1522238517,GET_CONFIG,,,
Wed Mar 28 15:01:58 2018 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Mar 28 15:01:58 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 62.149.128.4,dhcp-option DNS 62.149.132.4,dhcp-option DNS 8.8.8.8,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.1'
Wed Mar 28 15:01:58 2018 OPTIONS IMPORT: timers and/or timeouts modified
Wed Mar 28 15:01:58 2018 OPTIONS IMPORT: --ifconfig/up options modified
Wed Mar 28 15:01:58 2018 OPTIONS IMPORT: route options modified
Wed Mar 28 15:01:58 2018 OPTIONS IMPORT: route-related options modified
Wed Mar 28 15:01:58 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Mar 28 15:01:58 2018 ROUTE_GATEWAY 192.168.30.1/255.255.255.0 I=19 HWADDR=c8:5b:76:12:76:a2
Wed Mar 28 15:01:59 2018 ROUTE: bypass_host_route[0]=192.168.1.210
Wed Mar 28 15:01:59 2018 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Mar 28 15:01:59 2018 MANAGEMENT: >STATE:1522238519,ASSIGN_IP,,10.8.0.10,
Wed Mar 28 15:01:59 2018 open_tun, tt->ipv6=0
Wed Mar 28 15:01:59 2018 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{A905A570-F03D-40BE-A4FE-A3CC3DBD0B8B}.tap
Wed Mar 28 15:01:59 2018 TAP-Windows Driver Version 9.21
Wed Mar 28 15:01:59 2018 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.10/10.8.0.1 [SUCCEEDED]
Wed Mar 28 15:01:59 2018 MANAGEMENT: Client disconnected
Wed Mar 28 15:01:59 2018 ERROR: --ip-win32 dynamic [offset] : offset is outside of --ifconfig subnet
Wed Mar 28 15:01:59 2018 Exiting due to fatal error

TinCanTech

You are using --topology subnet .. so the CCD file should contain:

ifconfig-push 10.8.0.10 255.255.255.0

ionut

Thank you, that did the trick, now all my VPN clients have a designated IP. Now for the second problem, how can I make my Zoneminder instalation see the cameras from the OpenVPN subnet. If this is not a OpenVPN problem, just a linux or Debian related problem then I'll keep searching.

TinCanTech

See these articles:
HOWTO: Expanding the scope of the VPN to include additional machines
HOWTO: Routing all client traffic (including web-traffic) through the VPN
https://community.openvpn.net/openvpn/wiki/RoutedLans

Enjoy