greg wrotecan i do like this?
Sure. Is that dynamic enough for you though?
I was thinking to add a level of automation such as:
In server.conf, add the line for client connect script
client-connect /etc/openvpn/clientconnect.sh
client-disconnect /etc/openvpn/clientdisconnect.sh
and then in clientconnect.sh
#!/bin/bash
ip=$ifconfig_pool_remote_ip
last_octet = 1
random_num = $last_octet + ($RANDOM % 5)
iptables -t nat -A POSTROUTING -s $ip -o eth0 -j SNAT --to 113.111.77.$random_num
exit 0
and in clientdisconnect.sh
#!/bin/bash
ip=$ifconfig_pool_remote_ip
iptables -t nat -D POSTROUTING -s $ip -o eth0 -j SNAT --to 113.111.77.1
iptables -t nat -D POSTROUTING -s $ip -o eth0 -j SNAT --to 113.111.77.2
iptables -t nat -D POSTROUTING -s $ip -o eth0 -j SNAT --to 113.111.77.3
iptables -t nat -D POSTROUTING -s $ip -o eth0 -j SNAT --to 113.111.77.4
iptables -t nat -D POSTROUTING -s $ip -o eth0 -j SNAT --to 113.111.77.5
#why delete the same local ip 5 times? because due to the randomness
#factor of the connect script, and due to the fact that we are not using
#a mysql or other storage, we don't know what external IP was assigned.
#So we make 5 guesses and know that 1 is right, and the other 4 are harmless.
exit 0
Not the perfect coding but gives you a sense of the idea. Every time a client connects, a completely pseudo-random external IP is assigned.
With that said, the code provided by janjust will a great alternative.
iptables -t nat -A POSTROUTING -s 10.6.0.0/255.255.255.240 -o eth0 -j SNAT --to 113.111.77.1
iptables -t nat -A POSTROUTING -s 10.6.0.16/255.255.255.240 -o eth0 -j SNAT --to 113.111.77.2
iptables -t nat -A POSTROUTING -s 10.6.0.32/255.255.255.240 -o eth0 -j SNAT --to 113.111.77.3
iptables -t nat -A POSTROUTING -s 10.6.0.64/255.255.255.240 -o eth0 -j SNAT --to 113.111.77.4
iptables -t nat -A POSTROUTING -s 10.6.0.96/255.255.255.240 -o eth0 -j SNAT --to 113.111.77.5
And then find a way to assign random local IPs. If you don't assign random local IP then your first 15 clients will always get the same external IP.
