Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to openVPN and so far have setup Windows based openVPN server. Basic system is working fine as clients connect to openVPN server and are assigned virtual IPs like x.x.x.6, x.x.x.10, and so on.

I have 2 questions:

  1. What is the possibility to enable Virtual IP Lease. Like normal routers, can we set on openVPN server to lease a virtual IP for a particular client for some time, e.g. 24 hours. Within that time if that client connects back then it should be assigned same Virtual IP. Any solutions or ideas to persist client's Virtual IP over re-connections is needed.

  2. Is there any option in openVPN setup to include connected client's device MAC address along with their Real IP & Virtual IP in status.log file ?

share|improve this question

1 Answer 1

  1. If you configure a ifconfig-pool-persist file on the server it will try to allocate the same address to clients if possible.
  2. The status file does record both the real IP (under CLIENT LIST) and virtual IP (under ROUTING TABLE), although you need to correlate them based on the common name. The server doesn't know the client's real MAC address because that's a layer 2 concept.
share|improve this answer
    
1. I have tried ifconfig-pool-persist file but that didn't work at all. I mean ipp.txt file always remained empty. Also it seems like, this feature will work only in case of oVPN server restart, not client restart. 2. Is there a way to configure oVPN on layer 2 to get MAC address, i mean using some additional utilities etc. ? –  theGeekster Feb 7 '13 at 19:22
    
@theGeekster Have you checked the server logs for errors regarding ipp.txt? The VPN server isn't on the same layer 2 domain as the client (i.e. there are routers in between), so it doesn't ever see the client's MAC address. –  mgorven Feb 7 '13 at 19:27
    
This is found in server.log "WARNING: --ifconfig-pool-persist will not work with --duplicate-cn". Googled around this issue and pointed to this solution "forums.openvpn.net/topic7128.html";. But could not understand exactly how he is solving this problem. Please elaborate a bit. –  theGeekster Feb 8 '13 at 14:15
    
@theGeekster That's not related, it refers to statically configuring IPs, in which case the server/client pair for each client must be in the same /31 subnet. Do you have duplicate-cn enabled? What happens if you disable it? –  mgorven Feb 8 '13 at 17:11
    
Yes I have duplicate-cn enabled because we are have not generated separate certificate/key pair for each client. Didn't try disabling it, will give it a try (though that's not our case right now). –  theGeekster Feb 9 '13 at 14:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.