One OpenVPN for Multiple IPs

sens0r

Hi there, I own a VPS and I have installed OpenVPN on my CentOS with no problems on my main dedicated/static IP.
What I'd like to know is that if I have a second dedicated/static IP for the same VPS is it possible to switch between which IP I want to use with OpenVPN when I authenticate with a user + pass combination? If so how can I do this?

Thanks in advance

Bebop

Yes. Entirely possible, if not somewhat easy enough too.

Farmiliar with IPTABLES?

If so, its a combintaion of a 'client_connect' script, and a dynamic firewall rule, which is added when the client connects and removed when the client disconnects.

sens0r

Hi thanks for the quick reply. This is my first time buying and using a VPS so you can say I will need spoon feeding 🙂

I have followed this tutorial to setup my first connection:

http://www.webhostingtalk.com/showthread.php?t=1024872

What needs to be done to the above steps in order to use the second IP as I have mentioned in my first post?

Do I just add the new IP to "iptables" and create a new .conf file on the server and a matching .ovpn file on my computer for this to work?

Thank

Bebop

sens0r wroteWhat needs to be done to the above steps in order to use the second IP as I have mentioned in my first post?

Basically follow that guide (or any Centos guides out there), until you get a basic but
functional setup. Adding the custom IP should be donelast, when everything else is working fine.

What stage are you at now? Can you surf net through the tunnel? (assuming thats a function you're after).

sens0r

Yes as stated I have followed the above mentioned tutorial and already using my first IP without any problem.

So how do I add the second IP :roll:

Bebop

sens0r wrote:roll:

Dude...

Here we go:

create client-connect.sh and client-disconnect.sh, chmod to 755

cd /etc/openvpn
touch ./client-connect.sh
touch ./client-disconnect.sh
chmod 755 ./client-connect.sh
chmod 755 ./client-disconnect.sh

edit server.conf, add:

script-security 2
client-connect /etc/openvpn/client-connect.sh
client-disconnect /etc/openvpn/client-disconnect.sh

Bebop

client-connect.sh

#!/bin/bash
	
if [ $common_name != "common_name_here" ]
then
          iptables -t nat -A POSTROUTING -s $ifconfig_pool_remote_ip -o venet0 -j SNAT --to-source 111.255.111.111 #VPS IP 1
fi


if [ $common_name = "common_name_here" ]
then
          iptables -t nat -A POSTROUTING -s $ifconfig_pool_remote_ip -o venet0 -j SNAT --to-source 222.255.222.222 #VPS IP 2
fi

exit 0

client-disconnect.sh

#!/bin/bash
	
if [ $common_name != "common_name_here" ]
then
          iptables -t nat -D POSTROUTING -s $ifconfig_pool_remote_ip -o venet0 -j SNAT --to-source 111.255.111.111 #VPS IP 1
fi


if [ $common_name = "common_name_here" ]
then
          iptables -t nat -D POSTROUTING -s $ifconfig_pool_remote_ip -o venet0 -j SNAT --to-source 222.255.222.222 #VPS IP 2
fi

exit 0

not finished yet.

sens0r

I'll wait for you to provide all the instructions, I hope you can comment the instructions as well which would be very helpful and greatly appreciated.

sens0r

And what are these two files supposed to contain and how will they help me in utilizing both the IPs of my VPS?

sens0r

Wait a minute, I think you mis-understood me.

I will be the only one using the OpenVPN on my VPS, I just want to be able to select between the two IPs which I have for my VPS when I connect through the OpenVPN.

Can I not do this by simply adding the new IP into the "iptable" and generating new .conf and .ovpn files matching the second IP?

Bebop

sens0r wroteWait a minute, I think you mis-understood me.

I will be the only one using the OpenVPN on my VPS, I just want to be able to select between the two IPs which I have for my VPS when I connect through the OpenVPN.

Can I not do this by simply adding the new IP into the "iptable" and generating new .conf and .ovpn files matching the second IP?

Fo sure there's an easier way, if its just you. I thought you wanted to grant access based on username.

If its just for you personally, then the easiest way will be just to run 2 instances of openvpn on the server; 1 on port 1194, and 1 or port 1195 for example.

When a conection comes in on port 1194, it can go out of IP 1.
When a conection comes in on port 1195, it can go out of IP 2.

And u can just have a 2nd client.conf file, and in the 2nd client.conf will be the directive to connect to port 1195 instead of 1195.

Much simpler than the code I was about to give you. And less intrusive too. Wont have to change too much. Thank you for clarifying before it got any futher.

I see you're tracking this thread eagerly, which is great.. just gotta let u know, I will be AFk for bout 30 mins.

sens0r

Thanks I will give that a try, I will have to add the second IP into the "iptables" right?

Btw, if you would be kind enough to finish your initial instructions as they might come handy in the future and they might be useful for the other members as well 🙂 Take your time on it though until you have it all down 😃

Thanks!

Bebop

SOLUTION 1

Assuming you followed that other guide very closely, then you have a server.conf at /etc/openvpn/1194.conf

duplicate it:

cp /etc/openvpn/1194.conf /etc/openvpn/1195.conf

edit the 'port' line of 1195.conf to be:

port 1195

edit the 'server' line of 1195.conf to be:

server 10.10.99.0 255.255.255.0

I chose 10.10.99.0 arbitrarily. You can choose any numbers, so long as the 3rd octet (where I have 99) is different than your 1194.conf -- this important, because iptables will look at this later.

Now same at client side:

get your client.conf (or client.ovpn if windows) and duplicate it.

Give it a name that means something to you, like "AlternateIP.ovpn" or something.

Change the 'server' line to:

remote 123.123.123.123 1195

make note, that you didn't change the IP, but the port. Port is now 1195 (instead of 1194).

Last step is a change to iptables.

Simply add this to your iptables:

iptables -t nat -A POSTROUTING -s 10.10.99.0/24 -j SNAT --to-source 222.222.222.222

make note that 222.222.222.222 is the alternate VPS WAN IP that you want to utilize.

now

service openvpn restart

or whatever you did before to start the 1194 server, do the same for 1195 server. In the guide it looks like they used:

#openvpn /etc/openvpn/1195.conf &
#bg

type of start method. If thats what you did before, then stick with that.

Should be all working.

sens0r

Hi thanks for the quick reply, I was talking about instructions for the "Multi-user" system which you had partially stated earlier. But this is a gem too 🙂

Bebop

sens0r wroteI was talking about instructions for the "Multi-user" system which you had partially stated earlier.

Are you sure? Because I have delivered a solution according to:

sens0r wroteI will be the only one using the OpenVPN on my VPS, I just want to be able to select between the two IPs which I have for my VPS when I connect through the OpenVPN.

Can I not do this by simply adding the new IP into the "iptable" and generating new .conf and .ovpn files matching the second IP?

sens0r

Yes I'm sure as it would also come handy in the future 🙂

Thanks

Bebop

sens0r wroteYes I'm sure as it would also come handy in the future 🙂

OK.. I'll take my time with it. I had a new idea for it to make it a bit simpler..

If you can or if you desire, please do implement the other one I gave you, first.

The reason is, I thought of a way to simplify the next one. It will pigy back off the iptables i gave you in the last one, so it will be great to know if that implementation is working.

The next 1 will be based off username only.

[EDIT]

Actually, dont worry. Just wait. The next 1 is easier.

Bebop

SOLUTION 2

For this you only need 1 server.conf

After looking at your example/guide, lets say it looks like this:
1194.conf

local 123.255.123.123
port 1194
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name

##Im setting this to something practical:
server 10.10.1.0 255.255.255.0

push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

##Im adding some new lines:
client-config-dir /etc/openvpn/ccd
route 10.10.2.0 255.255.255.0

Create the afformentioned client-config-dir.
bash:

mkdir /etc/openvpn/ccd

What are your usernames? lets do example, "username1", "username2", "username5"

bash:

touch /etc/openvpn/ccd/username1
touch /etc/openvpn/ccd/username2
touch /etc/openvpn/ccd/username5

Edit /etc/openvpn/ccd/username1:

ifconfig-push 10.10.2.1 10.10.2.2

Edit /etc/openvpn/ccd/username2:

ifconfig-push 10.10.2.5 10.10.2.6

Edit /etc/openvpn/ccd/username5:

ifconfig-push 10.10.2.9 10.10.2.10

...more to follow...

IPTABLES:

 iptables -A FORWARD -s 10.10.1.0/24 -j ACCEPT
 iptables -A FORWARD -s 10.10.2.0/24 -j ACCEPT

#iptables -t nat -A POSTROUTING -s 10.10.1.0/24 -j SNAT --to 111.255.111.111
#iptables -t nat -A POSTROUTING -s 10.10.2.0/24 -j SNAT --to 222.255.222.111

A basic summary of what is happening:

Default VPN lan is 10.10.1.x
Secondary VPN lan is 10.10.2.x
Any user with a filename in ./ccd will be given a 10.10.2.x address
The 10.10.2.x address is hardcoded for each user: eg username1 10.10.2.1
IPTABLES will assign all the users with a 10.10.2.x address to the alternate WAN IP (222.255.222.222 or whatever)
Any user who's name is not in the ccd will simply get the default LAN of 10.10.1.x, and therefore the default (non alternate) WAN IP also.

This *is* the finished product. Its been tested and works.

Important note: learn your IP addressing schema for Windows. IP's can only be paired as

[ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] [ 17, 18]
[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]
[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]
[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]
[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]... and so on

more info: http://openvpn.net/index.php/open-source/documentation/howto.html

sens0r

Hi, I am adding the contents of my files:

1194.conf

local 123.123.123.123
port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server 1.2.3.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

1194.ovpn

client
dev tun
proto udp #- protocol
remote 123.123.123.123 1194
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
verb 3

I hope this gives you all the information you require. I have not implemented anything yet.

Let me know when the instructions are ready to be followed 🙂

sens0r

Bebop wrote
Edit /etc/openvpn/ccd/username1:

ifconfig push 10.7.1.4

Edit /etc/openvpn/ccd/username1:

ifconfig push 10.7.2.4

...more to follow...

For the part in red, don't you mean:

Edit /etc/openvpn/ccd/username2:

It seems you are trying to implementing both multi-user and multi-IP in this new method of yours, am I correct?

So I shall wait patiently as this looks interesting 🙂