Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an OpenVPN server running on a Linux-based firewall machine, with several permanent tunnels connected to it, and a couple of on-and-off "road-warrior" type connections. For the permanent connections I'd like to be able to use a host table entry on the accessing system to reference the machine on the other end of the tunnel. Since the tunnels are how I backup and admin the several EC2 instances I have running (instances are heavily firewalled except for ports needed for their functions). My problem is that if I take down one of the tunnels, when I restart it, it picks up another address in the subnet I've assigned to the vpn (10.10.10.0). When I first set the system up, I had host table entries on the admin machine on the internal network (192.168.100.0), but every time, I'd take one of the instances offline and connect to the instance via ssh (portknocked/other port connection), the instance would have picked up a different address from the vpn server. My question is whether there is a way to "reserve" a given address for a particular client in OpenVPN?? I've read the OpenVPN docs and don't see any obvious way to do this..

share|improve this question

1 Answer 1

You can use the CCD Directory to create custom configurations per SSL User, as long as the name of the file matches the Common Name that was used when generating the SSL cert. OpenVPN Documentation.

Below is a copy (with some changes ;p ) of my own config.

ifconfig-push 10.0.1.1 10.0.1.2
push "route 123.123.123.123 255.255.255.0"
share|improve this answer
    
+1 - Good show. You beat me to it by a few seconds. –  Evan Anderson Jul 15 '10 at 16:15
    
Thank you both very much!! –  LVDave Jul 15 '10 at 23:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.