Server/Client config for Static IPs (I'll buy you drinks)

teachjapan

First, I will preface this by saying: Anyone that helps me out with this, beers are on me if you ever come to Japan. I mean it.

Second, there's probably no one that knows less about VPNs on here than me. I am completely new to this. I REALLY need help.

I followed every step in the "VPN (The Easy Way) V24+" Wiki, so I've been able to set up OpenVPN on my DD-WRT Cisco WRT54GL (the WRT54GL box is currently the VPN server). So my clients can currently connect to my server, but right now the server is assigning virtual IPs radomly (through it's own DHCP??) What I'm trying to accomplish is setting static virtual IPs. The reason is: I have a Synology NAS box (sitting behind my VPN server) that I want any computer on my VPN to be able to access. I'm afraid that if the Synology box is ever turned off, then turned back on, it will be assigned a new virtual IP, then not be reachable by remote computers that I have mapped to its address. (A small note: through a small miracle, I've already been able to connect the Synology NAS as a client to the VPN. So that's already done.)

Here's my info:

My server config file:
-------------------------
push "route 192.168.54.0 255.255.255.0"
server 10.8.0.0 255.255.255.0

#route 10.8.1.0 255.255.255.0
#route 10.8.2.0 255.255.255.0

#client-config-dir /ccd

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

management localhost 5001
-------------------------

My ccd/chi-teach-1 file:
-------------------------
#ifconfig-push clientIP serverIP
ifconfig-push 10.8.0.14 10.8.0.13
-------------------------

My client config file:
-------------------------
remote xxxx.no-ip.org 1194

client
remote-cert-tls server
dev tun0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float

#If the pushed routes appear not to be added on windows hosts, add the following:
route-delay 30

ca ca.crt
cert chi-teach-1.crt
key chi-teach-1.key
-------------------------

My firewall command:
-------------------------
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
-------------------------

I've diligently read through the OpenVPN "HOW TO", trying to replicate to the best of my ability the "Configuring client-specific rules and access policies," so you can see in my server config file how I've commented out the route lines. (I wanted to put my offices different locations on different IP ranges.)

The ccd file... I actually have no idea if it's in the right location OR if the path in my server config file is correct.

The firewall code... the "10.8.0.0/24" entry looks like it can only see (??) request from the 10.8.0.0 address range. Do I need another line like "10.8.1.0/24" so it can see the 10.8.1.0 range?

Like I said, I'm pretty out of my league here. I think one of you probably knows how to fix this in a couple short lines.

If I get this fixed, beers are on me!

bnrstnr

You mentioned that the NAS is behind the server (router).. If it's on the same network as the server it wouldn't be a client. It doesn't sound like you need to have static IP addresses on your clients either, unless the NAS will only interact with specific IP addresses (unlikely)..

You might want to try the tap setup so every client is on the same network as the NAS. No need for the advanced routing, clients will be on the same subnet as if they were directly connected to it. Probably going to get flamed for suggesting the bridged setup, but I prefer to use it in most of my personal setups.. I find it just as easy to setup, as you don't have to traverse subnets or setup any advanced routing.

janjust

the line

#client-config-dir /ccd

in your server config needs to be uncommented; furthermore I'd recommend to use an absolute path, if that is not already the case).

To troubleshoot further, I'd add

verb 4
ccd-exclusive

that way , if the CCD file is NOT picked up correctly the client is refused access.

teachjapan

Thank you for your help. I really appreciate all of you trying to help me. So...

A) I'll try using a static path and the changes you've suggested.
B) I've changed my local LAN range to 172.16.1.0 from 192.168.1.1 (Honestly, I'm surprised that the whole thing has worked at all because my original "push 192.168.54.0 was a mistake, something I just copied from the installation Wiki.)

A different update:
I installed the OpenVPN software on on a computer at location 3 (the VPN server is at location 1) and I was able to connect to the server (it assigned a virtual IP) at location 1, but from there I can't ping any other IPs on the VPN. I have no idea why...?? (I disabled the Windows Firewall for the TAP adapter, as suggested in the HOW TO, but that didn't help.)

The computer at location 3 is behind another DD-WRT router (running PPPoE), but it has no special configuration/setup.

I REALLY need help here.

Like I said in my last message, I'm completely out of my league.

Do I need to add any special lines of code to the Firewall at location 3? At location 1? Why can't I ping the other machines on the VPN?

I'm lost...