Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have got working VPN connection through openvpn, but I would like to use also my DHCP server and not openvpn's push feature. Currently everything works fine, but I have to manually start dhcp client, eg. dhclient tap0 and I get IP and other important stuff from my DHCP, is there any directive which start DHCP Client when connection is established?

There is my client's config:

dev tap
port 1194
proto tcp-client
dev tap0

#route-up "dhclient tap0"


ca /etc/openvpn/ca.crt
cert /etc/openvpn/encyNtb_openvpn_client.crt
key /etc/openvpn/encyNtb_openvpn_client.key
dh /etc/openvpn/dh-openvpn.dh

ping 10
ping-restart 120

verb 5

log-append /var/log/openvpn.log

Here comes server's config:

mode server
dev tap0
port 1194
proto tcp-server

# Allow comunication between clients

# Allowing duplicate users per one certificate

# CA Certificate, VPN Server Certificate, key, DH and Revocation list
ca /etc/ssl/CA/certs/ca.crt
cert /etc/ssl/CA/certs/openvpn_server.crt
key /etc/ssl/CA/private/openvpn_server.key
dh /etc/ssl/CA/dh/dh-openvpn.dh
crl-verify /etc/ssl/CA/crl.pem

# When no response is recieved within 120seconds, client is disconected
keepalive 10 60


user openvpn
group openvpn

# Log and Connected clients file
log-append /var/log/openvpn
verb 3
status /var/run/openvpn/vpn.status 10

# Compression

#Push data to client
push "route-gateway"
push "redirect-gateway def1"
share|improve this question

Yes, it is possible.

if you pass "--up cmd" to the openvpn process.

the UP switch is defined as " Shell command to run after successful TUN/TAP device open (pre --user UID change). The up script is useful for specifying route commands which route IP traffic destined for private subnets which exist at the other end of the VPN connection into the tunnel."

share|improve this answer
Well I know about this option, but it is depending on current dhcp client application, isn't there anything more universal? And what about windows? – Ency Nov 27 '11 at 10:25
There isn't anything more universal. I would claim that the majority of folks have the vpn server assign the ips dynamically or use static ips defined for the client. – kormoc Feb 26 '13 at 6:03

You can use standard network management scripts from your distribution. I solved this problem in CentOS 6.6 and the trick was to use different interface name than tap0. The problem was that scripts assume that tap* interfaces are brought up during boot and that prevents hotplug scripts from configuring openvpn interface. So,

In the /etc/openvpn/client.conf write:

dev priv0
dev-type tap

instead of:

dev tap0

Next create configuration file /etc/sysconfig/network-scripts/ifcfg-priv0


And you are done! /etc/sysconfig/network-scripts/net.hotplug script will call "ifup priv0" after openvpn service has created priv0 interface. The problem however is that dhcp leases are not released when openvpn service is brought down. That's because interface is already removed when net.hotplug script is informed, so dhcp client cannot pass any data throug the tunnel. This could be fixed by adding pre-down script, like "ifdown priv0", to openvpn configuration. I had selinux running and I didn't bother to workout new rules to allow openvpn process call ifdown script.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.