Can OpenVPN Clients change IP addresses on the Server side?

Need help configuring your VPN? Just post here and you'll get that help.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
favelon
OpenVpn Newbie
Posts: 5
Joined: Sat Feb 27, 2021 7:31 pm

Can OpenVPN Clients change IP addresses on the Server side?

Post by favelon » Sat Feb 27, 2021 7:45 pm

Ok, I'm trying to make it simple. Is it possible for a OpenVPN Client to change the IP address it is talking on the destination network with? In my case the server talks with an IP of 10.10.0.4/16 on the destination network. All clients use the same IP on the destination obviously due to OpenVPN architecture (as I understand it).

Now I have more hosts on the same L2 network but different IP range let's say 10.128.0.0/16. They cannot be reached by the VPN client, there is no routing. Could a Client 'hack' his config so he talks with a 10.128.0.0/16 subnet address while being connected to the 10.10.0.4 OpenVPN server?

Yes, I am the admin and I can change all configs but this is more of a theoretical question. Cause if I create VPN accounts for my tenants I don't want them to reach the 10.128.0.0/16 network.

Cheers,


FYI this is my OpenVPN Client config (confidential data removed):
Client config

client
proto tcp-client
remote *.*.*.* *public port*
route-nopull
route 10.10.0.0 255.255.0.0
dhcp-option DNS 10.10.10.10
dhcp-option DOMAIN mgmt.lab
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_coUWOVLqgrOqJrPm name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
*****
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
*****
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
*****
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
*****
-----END OpenVPN Static key V1-----
</tls-crypt>
Last edited by Pippin on Sat Feb 27, 2021 7:50 pm, edited 1 time in total.
Reason: Formatting

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 9028
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by TinCanTech » Sat Feb 27, 2021 7:47 pm

favelon wrote:
Sat Feb 27, 2021 7:45 pm
Could a Client 'hack' his config so he talks with a 10.128.0.0/16 subnet address while being connected to the 10.10.0.4 OpenVPN server?
Easily.

favelon
OpenVpn Newbie
Posts: 5
Joined: Sat Feb 27, 2021 7:31 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by favelon » Sat Feb 27, 2021 8:02 pm

TinCanTech wrote:
Sat Feb 27, 2021 7:47 pm
favelon wrote:
Sat Feb 27, 2021 7:45 pm
Could a Client 'hack' his config so he talks with a 10.128.0.0/16 subnet address while being connected to the 10.10.0.4 OpenVPN server?
Easily.
Great, so how does it work? :D

favelon
OpenVpn Newbie
Posts: 5
Joined: Sat Feb 27, 2021 7:31 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by favelon » Sat Feb 27, 2021 8:10 pm

I can add a route to 10.128.0.0/16 on the client but the server doesn't have a route so doesn't forward the package

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 9028
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by TinCanTech » Sat Feb 27, 2021 8:22 pm

I did not say it would work .. that is all down to your network.

favelon
OpenVpn Newbie
Posts: 5
Joined: Sat Feb 27, 2021 7:31 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by favelon » Sat Feb 27, 2021 8:36 pm

Okay, I get you. That makes sense. But the server always performs NAT right? The client cannot get around that? Therefore it depends on the server IP and routing table at destination.

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 9028
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by TinCanTech » Sat Feb 27, 2021 8:42 pm

favelon wrote:
Sat Feb 27, 2021 8:36 pm
the server always performs NAT right?
If you configure it to do NAT .. otherwise no.

favelon
OpenVpn Newbie
Posts: 5
Joined: Sat Feb 27, 2021 7:31 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by favelon » Sat Feb 27, 2021 8:53 pm

Okay cool I think I understand now. It will actually all go into the tun0 interface and the rest entirely depends on the server OS and its routing table. Now I feel like it was a stupid question but anyway, I've figured it out and you helped me. THanks a lot!

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 9028
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can OpenVPN Clients change IP addresses on the Server side?

Post by TinCanTech » Sat Feb 27, 2021 9:12 pm

favelon wrote:
Sat Feb 27, 2021 8:53 pm
Now I feel like it was a stupid question
Nope, questions are simply questions..
favelon wrote:
Sat Feb 27, 2021 8:53 pm
I've figured it out and you helped me
You figured it out (with the least help) and now you understand 8-)

Post Reply