public ip address assign

leemklove

office A assign public_ip_address ==> (220.111.111.1 ~ 253)
office A openvpn = 220.111.111.253
office A pc useing = 220.111.111.1~50

office B openvpn eth1 wan(adsl) 111.222.111.1
eth0 - offic B pc
I want assign office B pc ==> 220.111.111.51~60

office C openvpn eth1 wan(adsl) 111.222.111.10
eth0 - offic C pc
I want assign office C pc ==> 220.111.111.61~100

Please HELP ME

janjust

buy my book, read the chapter on assigning public IPs , read the Errata page.

hschupp

Hi,
I did buy your book. There is nothing regarding chapter 12 though in the errata; not sure why you point these out.

I have a /29 public address subnet available and a server that is in the same subnet.

Here the /etc/network/interfaces script:

auto eth0
iface eth0 inet static
 address x.y.z.132
 netmask 255.255.255.248
 gateway x.y.z.129

The address range is x.y.z.112/29 (= x.y.z.112 - x.y.z.119)

Should this server.conf work in the above example?

proto udp
port 1194
dev tun
mode server
tls-server
ifconfig x.y.z.113 255.255.255.248
ifconfig-pool x.y.z.114 x.y.z.118
push "route x.y.z.132 255.255.255.255 net_gateway"
push "route-gateway x.y.z.129"
push "redirect-gateway def1"
ca       /etc/openvpn/keys/ca.crt
cert     /etc/openvpn/keys/server.crt
key      /etc/openvpn/keys/server.key
dh       /etc/openvpn/keys/dh384.pem
tls-auth /etc/openvpn/keys/ta.key 0
persist-key
persist-tun
keepalive 10 60
topology subnet
push "topology subnet"
script-security 2
client-connect /etc/openvpn/scripts/proxyarp-connect.sh
client-disconnect /etc/openvpn/scripts/proxyarp-disconnect.sh
log-append /var/log/openvpn.log

Any hint is welcome. Thanks

PS: Happy to email proof of purchase ;-)

janjust

this server config will almost work. The problem is in the IPs used , combined with the netmasks:

the LAN i/f of the server is at x.y.z.132/29
the LAN gateway connected to the server is at x.y.z.129 (netmask /29?)
the VPN range is x.y.z.112 - 119 /29

that's two separate networks, and the 'push x.y.z.132' you're using will not work, as you're crossing network boundaries.
Which public IP range is available (not just for VPN usage) ? what is the netmask of the LAN gateway?

hschupp

I need to give some background as I am not very clear I think.
I have a VPN server in a hosted data center. This server has a public IP x.y.z.132 and is connected to a gateway IP x.y.z.129. The gateway is out my control. The clients are routers in remote office locations. They are connected to the Internet via a satellite link with a dynamic IP address. I want them to receive a public IP through which they can be addressed remotely. I want to route all traffic from and to the routers through a VPN tunnel; the VPN tunnel should also assign the static public IP address under my control.

Here is a picture - the dark boxes are under my control, anything white is not.

janjust

I'm a bit confused about the tun address of the VPN server - is it .112 or .113 ?

the tricky part about your setup is that your public IP range does not seem to be in the same range as the IP range of the server itself (.112-119 vs .129); this can be solved using routing on the VPN server. If I read the picture and your setup correctly, I would use

ifconfig x.y.z.113 255.255.255.248
ifconfig-pool x.y.z.114 x.y.z.118
push "route-gateway x.y.z.113"

(the net_gateway push is not needed as the VPN IP range does not overlap with the WAN address of the VPN server itself)

hschupp

Well, I put x.y.z.114 there as your tutorial in the book seemed to suggest the address just above the vpn server address x.y.z.112 was not usable.

I quote:

10.0.0.18 : This is used for the server's VPN IP address
10.0.0.19 : Not available
10.0.0.20 - 10.0.0.25 : Available for VPN clients

So your 10.0.0.18 is my x.y.z.112, your 10.0.0.19 is not available as per your tutorial, so I assumed my x.y.z.113 was not available, and I could start only from x.y.z.114, the 10.0.0.20 in your example. Did I interpret your tutorial incorrectly? Does the x.y.z.114 make sense now?

janjust

ah, the example in my book is not the clearest one, I think...

in your case the full range is availabe , so you could use either .112 or .113 ; in my case the .19 address just happened to be used by another host. I left it in there , to show that you can hand out public IPs even if you do not have a contiguous IP range available.

hschupp

I hate to agree, but you are right. Maybe in your website and certainly in a second edition (i fully expect there will be one as the book is very good) :!: , you want to give an example with real public IPs.

hschupp

Sorry, one more question:
Is there any way to ensure the IP address assignment is permanent, say via assigning a certain IP address to a specific client MAC address as you can with most dhcp server?

hschupp

And another strange observation:

Your suggested configuration:

ifconfig x.y.z.113 255.255.255.248
ifconfig-pool x.y.z.114 x.y.z.118
push "route-gateway x.y.z.113"

works fine

I then tried

ifconfig x.y.z.112 255.255.255.248
ifconfig-pool x.y.z.113 x.y.z.118
push "route-gateway x.y.z.112"

which does not work, although the IP range is x.y.z.112/29 so from 112 through to 119.
(when I say 'it did not work' I mean some routes on the client were not built and I could not ping the vpn server x.y.z.112)

I am confused.

hschupp

I guess what I am asking is this:
Does this approach https://forums.openvpn.net/topic8212.html work for public IP address assignment as well?

janjust

I guess what I am asking is this:
Does this approach topic8212.html work for public IP address assignment as well?

yep should work

the IP range is x.y.z.112/29 so from 112 through to 119.

/29 translates to 255.255.255.248; so every network block starts at a multiple of 8; 112 is a multiple of 8. The first address of each block is always the network address and should be used, just like you cannot use the last address of the block, as it is the broadcast address.

If you really need to use these 2 addresses then you need to change your subnetting, but this might also require a change to the public IP/netmask of the openvpn server.

hschupp

Thank you very much indeed.

The setup works perfectly from the router on x.y.z.114 (and with an example of fixed IP address assignment also to x.y.z.115 or x.y.z.116 or x.y.z.117) and to the router from the outside world.

However, any traffic of devices connected to the router are going towards a.b.c.1 instead of x.y.z.113, so they are going via the public link instead of the tunnel. I am sure a proper route would fix it. I am surprised though, I thought the first default route pointing towards x.y.z.113 would make sure the second one pointing towards a.b.c.1 would never be used.

Any suggestions what might be going wrong for those PCs connected to the router?

Thanks

root@Router4388:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         x.y.z.113   128.0.0.0       UG    0      0        0 tun0
default         a.b.c.1   0.0.0.0         UG    0      0        0 eth0.2
x.y.z.0     *               255.255.255.0   U     0      0        0 tun0
x.y.z.132   a.b.c.1   255.255.255.255 UGH   0      0        0 eth0.2
128.0.0.0       x.y.z.113   128.0.0.0       UG    0      0        0 tun0
a.b.c.0   *               255.255.240.0   U     0      0        0 eth0.2
192.168.12.0    *               255.255.255.0   U     0      0        0 br-lan

janjust

the route via tun0 and via eth0.2 have the same metric ; what happens if you run a 'traceroute' ? what happens if you change the default metric for the eth0.2 route?

hschupp

The tracert response I get is this:

C:\Users\Hanno Schupp>tracert www.openwrt.org

Tracing route to www.openwrt.org [78.24.191.177]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  Router0004253257.lan [192.168.12.1]
  2  Router0004253257.lan [192.168.12.1]  reports: Destination protocol unreacha
ble.

Trace complete.

I repeat the tracert after setting the metric of eth0.2 to 100.
Same tracert response as above - no change

hschupp

It was a firewall issue on the OpenWrt based server, which prevented packets being forward from the incoming network (lan) to the outgoing network (vpn); the standard OpenWrt configuration assumes the outgoing network to be wan.
The solution can be found here:
https://forum.openwrt.org/viewtopic.php?pid=84470#p84470
Curiously the push "redirect-gateway def1" route addition on the openvpn client (the router no longer works though, after this configuration has added, but the principle issue has been resolved. Thank You

The auto route creation issue for "redirect-gateway def1":
The above config prevents the additional routes from being created which one would expect from the "push "redirect-gateway def1"" (or "redirect-gateway def1" in client config - it makes no difference where the routes are defined).
The two routing statements

/sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw x.y.z.113
/sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw x.y.z.113

are not created automatically although they appear in the logfile as to be created.
When I add them manually after the vpn link is up all works fine.

What might prevent these rules from being created?

janjust

with 'verb 5' set in the client log file you should see the exit code (error?) of the 'ip route' commands - can you check the exit codes & post them here?

hschupp

Figured it out myself in the end.

Again, a firewall issue. As you can see below where the tun0 interface on creation is connected to the firewall zone of OpenWrt. This has to happen before the routes are created. this can be achieved by adding

route-delay 10

to the client config file of openwrt.
If this parameter is not set, then OpenVPN will try and set the route before the firewall has attached tun0 to the vpn firewall zone and the route add actions will fail.

Problem! Firewall aconfig occurs after attempt to route. Route will fail:

Apr 16 05:08:47 Router8111215 daemon.notice openvpn(custom_config)[6296]: SENT CONTROL [openvpnserver]: 'PUSH_REQUEST' (status=1)
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: PUSH: Received control message: 'PUSH_REPLY,route-gateway  x.y.z.193,redirect-gateway def1,topology subnet,ping 10,ping-restart 60,ifconfig x.y.z.196 255.255.255.0'
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: OPTIONS IMPORT: timers and/or timeouts modified
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: OPTIONS IMPORT: --ifconfig/up options modified
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: OPTIONS IMPORT: route options modified
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: OPTIONS IMPORT: route-related options modified
Apr 16 05:08:48 Router8111215 daemon.warn openvpn(custom_config)[6296]: WARNING: potential conflict between --remote address  x.y.z.173] and --ifconfig address pair [x.y.z.196, 255.255.255.0] -- this is a warning only that is triggered when local/remote addresses exist
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: TUN/TAP device tun0 opened
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: TUN/TAP TX queue length set to 100
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: /sbin/ifconfig tun0  x.y.z.196 netmask 255.255.255.0 mtu 1500 broadcast  x.y.z.255
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: /sbin/route add -net  x.y.z.173 netmask 255.255.255.255 gw 192.168.20.1
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw  x.y.z.193
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw  x.y.z.193
Apr 16 05:08:48 Router8111215 daemon.notice openvpn(custom_config)[6296]: Initialization Sequence Completed
Apr 16 05:08:49 Router8111215 user.notice ifup: Enabling Router Solicitations on vpn (tun0)
Apr 16 05:08:49 Router8111215 user.info firewall: removing vpn (tun0) from zone vpn
Apr 16 05:08:49 Router8111215 user.info firewall: adding vpn (tun0) to zone vpn

After setting "route-delay 10"

Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: SENT CONTROL [openvpnserver]: 'PUSH_REQUEST' (status=1)
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: PUSH: Received control message: 'PUSH_REPLY,route-gateway x.y.z.193,redirect-gateway def1,topology subnet,ping 10,ping-restart 60,ifconfig x.y.z.196 255.255.255.0'
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: OPTIONS IMPORT: timers and/or timeouts modified
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: OPTIONS IMPORT: --ifconfig/up options modified
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: OPTIONS IMPORT: route options modified
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: OPTIONS IMPORT: route-related options modified
Apr 16 04:59:04 Router8111215 daemon.warn openvpn(custom_config)[5835]: WARNING: potential conflict between --remote address [x.y.z.173] and --ifconfig address pair [x.y.z.196, 255.255.255.0] -- this is a warning only that is triggered when local/remote addresses exist
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: TUN/TAP device tun0 opened
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: TUN/TAP TX queue length set to 100
Apr 16 04:59:04 Router8111215 daemon.notice openvpn(custom_config)[5835]: /sbin/ifconfig tun0 x.y.z.196 netmask 255.255.255.0 mtu 1500 broadcast x.y.z.255
Apr 16 04:59:05 Router8111215 user.notice ifup: Enabling Router Solicitations on vpn (tun0)
Apr 16 04:59:05 Router8111215 user.info firewall: removing vpn (tun0) from zone vpn
Apr 16 04:59:06 Router8111215 user.info firewall: adding vpn (tun0) to zone vpn
Apr 16 04:59:14 Router8111215 daemon.notice openvpn(custom_config)[5835]: /sbin/route add -net x.y.z.173 netmask 255.255.255.255 gw 192.168.20.1
Apr 16 04:59:14 Router8111215 daemon.notice openvpn(custom_config)[5835]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw x.y.z.193
Apr 16 04:59:14 Router8111215 daemon.notice openvpn(custom_config)[5835]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw x.y.z.193
Apr 16 04:59:14 Router8111215 daemon.notice openvpn(custom_config)[5835]: Initialization Sequence Completed