Sporadic OpenVPN node IP address changes

samco82

I've been having these very sporadic episodes of random IP changes with my OpenVPN nodes. It rarely happens, but when it does, it affects the monitoring tools that are pointing to those IPs. This issue usually affects 1 or 2 nodes out of 42.

I don't have any static IP set up or anything special on my config, when a node first joins, a random IP is assigned but these are very persistent so I have no idea what's going on here.

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
compress lz4-v2
push "compress lz4-v2"
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3

client
dev tun1
proto udp
remote foobarbaz.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca keys/ca.crt
cert keys/node.crt
key keys/node.key
ns-cert-type server
compress lz4-v2
verb 3

ordex

I presume using 'ifconfig-pool-persist' has exactly the goal to keep assignments static. However, the manpage says:

Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, use --ifconfig-push

So there might be some reason why the assignment cannot be kept. Maybe the server log will say something (I'd suggest to use verb 4 to get extra info)

Pippin

Hi,

ordex wrote So there might be some reason why the assignment cannot be kept. Maybe the server log will say something (I'd suggest to use verb 4 to get extra info)

Probably the keepalive mechanism?

.
See the manual for the directives: https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html
And wiki: https://community.openvpn.net/openvpn/wiki/HOWTO#ExpandingthescopeoftheVPNtoincludeadditionalmachinesoneithertheclientorserversubnet

Possibly a "better" way is to assign static tunnel IPs to clients via ccd.
This can be for all or not all clients.
Clients need a unique certificate.

client-config-dir /etc/openvpn/ccd

If for all clients one can add:

ccd-exclusive

Then use:

topology subnet
server 10.8.0.0 255.255.255.0 'nopool'
ifconfig-pool 10.8.0.16 10.8.0.254

In this case .16 till .254 are dynamically allocated and .2 till .15 can be used for static assignment.
Adjust as needed.
.0, .1 and .255 cannot be assigned to clients in this case (for recent OpenVPN version, if older .254 also cannot be assigned).

I would also look into --explicit-exit-notify.

For the above one needs to remove:

ifconfig-pool-persist ipp.txt

ordex

Pippin wrote Hi,

ordex wrote So there might be some reason why the assignment cannot be kept. Maybe the server log will say something (I'd suggest to use verb 4 to get extra info)

Keep alive should not matter because when reconnecting with the same CN the client should take over the old instance entirely - but can't be sure 100% 😃