Clients sometimes get same IP as other clients

[deleted]

Sometimes my clients get the same IPs as other clients.
Ideally I'd like to be able to have clients' IPs persist without having to set a static IP for every single one as that obviously becomes an administrative nightmare for large numbers of clients.

We use OpenVPN to connect our clients to our domain, and our DC is our DNS server. Because clients are sometimes getting the same IPs, we see DNS issues whereby hostname client1 and hostname client2 will both be mapped to 10.8.0.X, and then trying to contact a client via their computer name will fail because their computer name is mapped to a VPN IP that has been given to another machine.

I've noticed this only happens with some clients, but some clients will consistently get the same IP. For example, we have static DNS entries created on our domain controller for a server that is mapped to 10.8.0.200, and that IP has been consistently assigned to the server for over a year.

I do have ifconfig-pool-persist ipp.txt enabled, and I've noticed that disabling the option causes the clients with persisting IPs like the server mentioned above to no longer persist, so the option seems like it's partially working.

Any help or advice would be greatly appreciated. Here's my server.conf file(with a couple of push routes omitted):

port 1194

proto udp

dev tun

ca ca.crt
cert server.crt
key server.key

dh dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

client-config-dir /etc/openvpn/ccd

client-to-client

keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log

log openvpn.log

verb 4

crl-verify crl.pem

TinCanTech

See --ifconfig-pool-persist in the manual ..

[deleted]

I quite genuinely have read plenty of information about ifconfig-pool-persist, and you can see that the option is in my server config.
Maybe if you believe I've missed something, you could point it out. People do make mistakes and overlook things.

Do you actually have an idea, or are you simply trying to be a smartass telling someone to read the manual? :/

TinCanTech

If you read the manual then you will learn why your setup does not do what you want ..

Otherwise, just stumble along like a blind man -- smart arse.

ecrist

Are you sharing certificates among the same clients?

ecrist

What @tincantech was trying to point out from https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage:

--ifconfig-pool-persist file [seconds]
Persist/unpersist ifconfig-pool data to file, at seconds intervals (default=600), as well as on program startup and shutdown.
The goal of this option is to provide a long-term association between clients (denoted by their common name) and the virtual IP address assigned to them from the ifconfig-pool. Maintaining a long-term association is good for clients because it allows them to effectively use the --persist-tun option.

file is a comma-delimited ASCII file, formatted as <Common-Name>,<IP-address>.

If seconds = 0, file will be treated as read-only. This is useful if you would like to treat file as a configuration file.

Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, use --ifconfig-push

Note the italicized section above.

[deleted]

The issue actually ended up being that our version of OpenVPN was using the net30 topology mode, so ifconfig-pool-persist was unable to continuously give out the same IPs as we had more clients than we had /30 masks available for.

After changing the mode to subnet mode, ifconfig-pool-persist now successfully maintains the IPs for each client :-)

Thanks for your help, @ecrist.