derpascal
Hi,
we have running several openvpn daemons (different ip addresses, port and proto) on one node. All of them are connected to the same local bridge, running in tap mode and all are using the same client-config-dir to pin with "ifconfig-push" on each client certificate an IP address. The gateway IP is running on the brdige. The clients can connect to the different IP/PORT/PROTO, get always the same IP, give each IP different ACLs via iptables and the connection is working fine.
But the clients can set another IP addresses on client site that are reserved for another client and can "steal" the ACLs. Of course if booth clients are up than the network is not working good for booth of them. I understand the reason for it, but is there a way to prevent us for this case. like IP-Pinning? Static Arp? Other ways?
Regards
Pascal
