8

I'm trying to setup an OpenVPN server which would dynamically assign clients their IP addresses from given range and I need the server to have a specific static IP address which does not lie at the start of the address range (e.g. 192.168.0.200 instead of 192.168.0.1). Here's my server configuration file:

mode server
port 1134
proto tcp6-server
dev tap
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 192.168.0.0 255.255.255.0
; the following line does not work :-(
ifconfig 192.168.0.200 255.255.255.0
client-to-client
duplicate-cn
keepalive 10 120
cipher AES-256-CBC
comp-lzo
max-clients 32
verb 15
mute 10

After studying the documentation and examples on the net I thought the "ifconfig ..." line would do the trick, but openvpn keeps assigning 192.168.0.1 to the virtual interface (tap0). During openvpn server initialization, this line can be seen:

Fri Apr  4 14:58:07 2014 us=410085 /sbin/ifconfig tap0 192.168.0.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.0.255

Why is openvpn ignoring the "ifconfig ..." line? I don't know if it is relevant, but I use openvpn 2.3 and Ubuntu OS.

Any suggestions?

3 Answers 3

2

I point you to the documentation for the --server option. If you want to manually specify things do not use the --server option. Instead manually put in the directives you want. See the full man page for a listing of what --server does.

   --server network netmask
          A helper directive designed to  simplify  the  configuration  of
          OpenVPN's  server  mode.   This directive will set up an OpenVPN
          server which will allocate addresses to clients out of the given
  ->>>>   network/netmask.   The  server itself will take the ".1" address
          of the given network for use as the server-side endpoint of  the
          local TUN/TAP interface.

          For example, --server 10.8.0.0 255.255.255.0 expands as follows:

               mode server
               tls-server
               push "topology [topology]"

               ...

               if dev tap OR (dev tun AND topology == subnet):
                 ifconfig 10.8.0.1 255.255.255.0
                 if !nopool:
                   ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
                 push "route-gateway 10.8.0.1"
3
  • I use a configuration file for my server and have the exact same question. Your answer suggests that I should rewrite the assignment part in the config file (in other words, replicate the code below the ... in my config file (with the IP I want to assign). Is that correct? How does this code overwrites the default one (which also uses ifconfig, as seen in the logs)
    – WoJ
    Mar 31, 2016 at 11:17
  • @Zoredache please include a fully working config example in your answer. As far as I know, the "if ... else" constructs are pseudo-code, and not actually supported in the config file.
    – valentt
    Nov 9, 2016 at 11:25
  • @valentt I copied straight from the man page. You are correct that it is psuedo-code, but it is psuedo code, that is telling you how you build your configuration, if you look at the full man page, you can even see that I trimmed down the excerpt. I mostly think people should actually read the man page, which at least to me is pretty clear.
    – Zoredache
    Nov 9, 2016 at 17:52
7

For example if you wish that your server uses 10.8.0.254 IP instead 10.8.0.1 then you need to make few changes to your config file.

First change "proto tcp" or "proto udp" line into "proto tcp-server" or "proto udp-server"

Then comment out this line:

server 10.8.0.0 255.255.255.0

and add these lines instead:

mode server
tls-server
ifconfig 10.8.0.254 10.8.0.253
ifconfig-pool 10.8.0.1 10.8.0.252
route 10.8.0.0 255.255.255.0
push "route 10.8.0.254"

restart openvpn service and that is it.

-1

Worked for me (from first answer):

comment out line:

server 10.8.0.0 255.255.255.0

add lines instead:

mode server
tls-server
push "topology [topology]"

ifconfig 10.8.0.254 255.255.255.0
ifconfig-pool 10.8.0.1 10.8.0.253 255.255.255.0
push "route-gateway 10.8.0.254"
1
  • 3
    this is just a copy paste from the answer above
    – bocian85
    Jan 7, 2019 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .