Hi,
I have a small setup running which assigns public ip to the connecting clients. First i created it by making the server use the ip addresses and iptables to change the lan ip address to public and back. This had the advantage of being very easy to setup and relatively fast, but in case of any error the iptables rule can get stuck and -the reason i wanted to change- the server had to use the ip prior to assignment, thus if i want to use more servers (for loadbalance) to use the same ip pool i have to divide it.
I tried experimenting with bridge setup, which was working excellent. However, recently i changed to esxi and bridge presented a huge performance drop. This is because if i want to use bridge in esxi i had to allow promiscous mode and the virtual openvpn server will receive all the packets arriving to the physical nic, making even the idle server with no clients connected consume 600-800mhz and dstat showing a constant traffic.
After some consideration i wanted to try an arp proxy setup, but no luck and not sure what was wrong. I dont really grasp what i should be doing, turning on arp proxy in sysctl didnt work, neither using parprouted.
Please help me find the best solution and make it work 🙂
I use this setup for the bridge and i tried with the same for the arp proxy setup
server
mode server
dev tap0
port 443
proto tcp-server
tls-server
dh /etc/openvpn/ssl/dh1024.pem
cert /etc/openvpn/ssl/server.crt
key /etc/openvpn/ssl/server.key
ca /etc/openvpn/ssl/ca.crt
reneg-sec 216000
ifconfig aa.aa.aa.aa 255.255.255.128
push "route-gateway aa.aa.aa.aa"
push "dhcp-option DNS xx.xx.xx.xx"
push "dhcp-option DNS xx.xx.xx.xx"
push "redirect-gateway def1"
keepalive 5 60
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
log /var/log/openvpn/main201.log
verb 1
mute 10
username-as-common-name
tun-mtu 1500
tun-mtu-extra 32
max-clients 30
auth-user-pass-verify "/etc/openvpn/auth.sh" via-env
script-security 3
tmp-dir "/tmp"
tcp-queue-limit 128
txqueuelen 200
tcp-nodelay
inactive 600
client-connect /etc/openvpn/clientconnect
client-disconnect /etc/openvpn/clientdisconnect
management 127.0.0.1 12322 pass.management
engine aesni
cipher aes-128-cbc
clientconnect
...
echo -e "ifconfig-push '$IP' 255.255.255.128\n" > $1
echo -e "push 'ifconfig-nowarn'\n" >> $1
