How to increase the IP range for static IPs

mycroftholmes

Hello!

I'm trying to set up a server that has over 1000 usable IPs, so I could in theory assign a static ip to that many devices. I have been able to set up an OpenVPN server with a /24 (mask 255.255.255.0) and assign fixed IPs. However on a new server I did the exact same things except I changed my range to a /16 (mask 255.255.0.0) this lets me assign the IPs, and my client will show with a fixed is such as 10.8.200.200, however, I am unable to ping the client from the server, or ssh into it. Although the client can ping the server ip. I just replaced all the places that 255.255.255.0 appeared to 255.255.0.0

Here is my server.conf:

port 443
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.0.0
client-config-dir ccd
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 67.207.67.3"
push "dhcp-option DNS 67.207.67.2"
keepalive 10 60
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

Here is an example of my ccd/cliente1
[oconf = ccd/cliente1]
ifconfig-push 10.8.200.200 255.255.0.0
[/oconf]

Here is my cliente1.ovpn

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote ServerIP 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
route-nopull
verb 3

My server logs:

Jul 30 20:07:18 wideip ovpn-server[3422]: 24.87.208.193:39548 TLS: Initial packet from [AF_INET]:39548, sid=40807cd2 796f6699
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 CRL CHECK OK: CN=ChangeMe
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 VERIFY OK: depth=1, CN=ChangeMe
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 CRL CHECK OK: CN=cliente1
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 VERIFY OK: depth=0, CN=cliente1
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Jul 30 20:07:19 wideip ovpn-server[3422]: 24.87.208.193:39548 [cliente1] Peer Connection Initiated with [AF_INET]clientIP:39548
Jul 30 20:07:19 wideip ovpn-server[3422]: cliente1/24.87.208.193:39548 OPTIONS IMPORT: reading client specific options from: ccd/cliente1
Jul 30 20:07:19 wideip ovpn-server[3422]: cliente1/24.87.208.193:39548 MULTI: Learn: 10.8.200.200 -> cliente1/clientIP:39548
Jul 30 20:07:19 wideip ovpn-server[3422]: cliente1/24.87.208.193:39548 MULTI: primary virtual IP for cliente1/clientIP:39548: 10.8.200.200
Jul 30 20:07:21 wideip ovpn-server[3422]: cliente1/24.87.208.193:39548 PUSH: Received control message: 'PUSH_REQUEST'
Jul 30 20:07:21 wideip ovpn-server[3422]: cliente1/24.87.208.193:39548 send_push_reply(): safe_cap=940
Jul 30 20:07:21 wideip ovpn-server[3422]: cliente1/24.87.208.193:39548 SENT CONTROL [cliente1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 67.207.67.3,dhcp-option DNS 67.207.67.2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.8.200.200 255.255.0.0' (status=1)
Jul 30 20:07:26 wideip ovpn-server[3422]: event_wait : Interrupted system call (code=4)
Jul 30 20:07:26 wideip ovpn-server[3422]: Closing TUN/TAP interface
Jul 30 20:07:26 wideip ovpn-server[3422]: /sbin/ip addr del dev tun0 10.8.0.1/16

Jul 30 20:08:54 ubnt openvpn[2922]: VERIFY EKU OK
Jul 30 20:08:54 ubnt openvpn[2922]: VERIFY OK: depth=0, CN=server
Jul 30 20:08:55 ubnt openvpn[2922]: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Jul 30 20:08:55 ubnt openvpn[2922]: Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Jul 30 20:08:55 ubnt openvpn[2922]: Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Jul 30 20:08:55 ubnt openvpn[2922]: Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Jul 30 20:08:55 ubnt openvpn[2922]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Jul 30 20:08:55 ubnt openvpn[2922]: [server] Peer Connection Initiated with [AF_INET]:443
Jul 30 20:08:57 ubnt openvpn[2922]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Jul 30 20:08:57 ubnt openvpn[2922]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 67.207.67.3,dhcp-option DNS 67.207.67.2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.8.200.200 255.255.0.0'
Jul 30 20:08:57 ubnt openvpn[2922]: Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Jul 30 20:08:57 ubnt openvpn[2922]: Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Jul 30 20:08:57 ubnt openvpn[2922]: Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Jul 30 20:08:57 ubnt openvpn[2922]: OPTIONS IMPORT: timers and/or timeouts modified
Jul 30 20:08:57 ubnt openvpn[2922]: OPTIONS IMPORT: --ifconfig/up options modified
Jul 30 20:08:57 ubnt openvpn[2922]: OPTIONS IMPORT: route-related options modified
Jul 30 20:08:57 ubnt openvpn[2922]: TUN/TAP device vtun0 opened
Jul 30 20:08:57 ubnt openvpn[2922]: TUN/TAP TX queue length set to 100
Jul 30 20:08:57 ubnt zebra[351]: interface vtun0 index 12 <POINTOPOINT,NOARP,MULTICAST> added.
Jul 30 20:08:57 ubnt openvpn[2922]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Jul 30 20:08:57 ubnt openvpn[2922]: /sbin/ip link set dev vtun0 up mtu 1500
Jul 30 20:08:57 ubnt zebra[351]: interface vtun0 index 12 changed <UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>.
Jul 30 20:08:57 ubnt openvpn[2922]: /sbin/ip addr add dev vtun0 10.8.200.200/16 broadcast 10.8.255.255
Jul 30 20:08:57 ubnt openvpn[2922]: Initialization Sequence Completed

Any help would greatly be appreciated.

TinCanTech

mycroftholmes wrote I just replaced all the places that 255.255.255.0 appeared to 255.255.0.0

Not a great plan ..

mycroftholmes wrote Cliente1 Config
<..>
route-nopull

Pourquoi ? :roll:

mycroftholmes

Hey, Yeah the replacing didn't work. I'm still not sure how to get that many IPs. The reason I put

route-nopull

is because the client is a router. I want its traffic to go through normal. I just need to ssh into it and maybe send some info through the tunnel from the router.

TinCanTech

You have already gone to the trouble of using client CCD's .. why not learn how they work ?

IE: Only push redirect-gateway to clients that you wish to receive it.

Either way, --route-nopull is far to restrictive in your case.

mycroftholmes

I tried adding additional routes ie: 10.8.1.0 255.255.255.0 in my server.conf and it allowed me to do that. I was just wondering if there was a method where I could add a lot at a time other than adding 254 IPs at a time.

Also: I saw this https://community.openvpn.net/openvpn/wiki/Concepts-Addressing and it says that I cannot use the server directive because its static addressing, but in this case I am using server and its working.

Should I change it to something like:

--mode server
--tls-server
--dev tun
--topology "subnet"
--push "topology subnet"
--ifconfig 10.8.0.1 255.255.255.0
--push "route-gateway 10.8.0.1"
--ifconfig-pool 10.8.0.2 10.8.0.199 255.255.255.0
--client-config-dir /vpn/ccd-dir

Also, I looked into route-nopull and I cant find anything better in my case other than creating a lot of exceptions.

mycroftholmes

On a new server I did the following:

My server.conf

port 443
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 67.207.67.3"
push "dhcp-option DNS 67.207.67.2"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
client-config-dir ccd

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote My IP 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
route-nopull
verb 3

In the ccd/client I put: ifconfig-push 10.8.1.9 255.255.255.0

And I can see when the client is connected on the server but I am unable to ping/ssh it. So I cant even assing 10.8.1.0 Ips. hmm.

Client log:
https://pastebin.com/QXsMHzge

Server log:
https://pastebin.com/9fnUzb5n

TinCanTech

In your server log it shows that you are pushing a /24 IP to the client ..

mycroftholmes wrote Also: I saw this https://community.openvpn.net/openvpn/wiki/Concepts-Addressing ... Addressing and it says that I cannot use the server directive because its static addressing, but in this case I am using server and its working

That Code be more of a Guide .. You are off the map :mrgreen: yoho me harties, drink up! .... and really bad eggs.

mycroftholmes

if its this https://pastebin.com/9fnUzb5n the of course it does in that example I changed it to 255.255.255.0 which is /24. In the first part you can see that im pushing /16 in the log.

that Code be more of a Guide .. You are off the map :mrgreen: yoho me harties, drink up! .... and really bad eggs.

I would really like to drink, but how can I if im trying to figure this out and the guides arent very helpful.

mycroftholmes

I see what you mean now. It worked. Cheers.

TinCanTech

mycroftholmes wrote its this https://pastebin.com/9fnUzb5n the[n] of course it does in that example I changed it to 255.255.255.0 which is /24

sort of lost for words here ..

mycroftholmes wrote In the first part you can see that im pushing /16 in the log.

I do not see that ..

mycroftholmes wrote I would really like to drink, but how can I if im trying to figure this out

Why is the Rum always gone .. ?

mycroftholmes wrote and the guides arent very helpful.

You can help improve them ..

search: openvpn contributing