Set client IP address via post-auth or client-connect script

alfredballe

Is it possible with OpenVPN 2.4 to set a clients IP address from the 10.8.0.0/24 subnet via a post-auth or client-connect script in Python?

I haven't been able to find any specific information on this.

alfredballe

It seems there's mentioned example script in https://openvpn.net/vpn-server-resources/post-auth-programming-notes-and-examples/, but I do not have /usr/local/openvpn_as/doc/post_auth it seems?

TinCanTech

That is OpenVPN Access Server documentation.

Try the open source stuff on the wiki.
https://community.openvpn.net/openvpn/wiki/TitleIndex

alfredballe

Ok, I've added in server.conf:
client-connect /etc/openvpn/client-connect.py

And my client-connect.py is as follows:

import os
import sys

if [os.environ['username'] == 'alfred':
    print('ifconfig-push 10.8.0.11 255.255.255.0')
    sys.exit(0)

sys.exit(1)

I see no errors in syslog, but IP address is not assigned.

alfredballe

Changed to:

with open(sys.argv[1], "a") as tmpfile:
    tmpfile('ifconfig-push 10.8.0.11 255.255.255.0')

Now I'm getting, from the client not the server, error:

"TUN setup failed: tun_prop_error: ifconfig addresses are not in the same /30 subnet'

My server.conf has:

...
server 10.8.0.0 255.255.255.0
...
push "route 100.100.0.0 255.192.0.0"
...

alfredballe

It seems to work with the following addons:

In server.conf

topology subnet

In client-connect

with open(sys.argv[1], "a") as tmpfile:
    tmpfile('ifconfig-push 10.8.0.11 255.255.255.252')

Does that seem correct, just to make sure things are configured correctly?

TinCanTech

--topology subnet uses a /24 subnet not /30 as you have chosen above.

alfredballe

Ok, so I should either change:

with open(sys.argv[1], "a") as tmpfile:
    tmpfile('ifconfig-push 10.8.0.11 255.255.255.252')

To match subnet /24 or or remove below to match /30

topology subnet

Is that correct? Even though it seems to work this way?