Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a debian 64bit vps, OpenVZ, with perfectly working openvpn server.

I have ADDITIONAL IP which I want to use on that same openvpn server and I can't make it work. It only works if I specify "local ADDITIONAL-IP" directive in openvpn.conf, but then the first IP does not work. If I specify "local" directive two times, neither work.

root@deal1:/etc/openvpn# ifconfig lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:12 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1338 (1.3 KiB) TX bytes:1338 (1.3 KiB)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.186.35.1 P-t-P:10.186.35.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.186.36.1 P-t-P:10.186.36.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.2 P-t-P:127.0.0.2 Bcast:0.0.0.0 Mask:255.255.255.255 inet6 addr: 2607:ff28:0:12::c4e:18e5/128 Scope:Global inet6 addr: 2607:ff28:0:12::2ad7:f2b1/128 Scope:Global inet6 addr: 2607:ff28:0:12::86d5:56d4/128 Scope:Global inet6 addr: 2607:ff28:0:12::9d21:aba3/128 Scope:Global UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1 RX packets:38904 errors:0 dropped:0 overruns:0 frame:0 TX packets:20408 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:53671396 (51.1 MiB) TX bytes:1712747 (1.6 MiB)

venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:X.2.39.161 P-t-P:X.2.39.161 Bcast:0.0.0.0 Mask:255.255.255.255 UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1

venet0:5 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:X.2.39.162 P-t-P:X.2.39.162 Bcast:0.0.0.0 Mask:255.255.255.255 UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1

iptables:

-A POSTROUTING -s 10.186.35.0/24 -j SNAT --to-source X.2.39.161   
-A POSTROUTING -s 10.186.35.0/24 -j SNAT --to-source X.2.39.162

openvpn config:

server 10.186.35.0 255.255.255.0
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
#push "route 0.0.0.0 0.0.0.0"
#push "redirect-gateway"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 208.67.222.222"
keepalive 10 120
comp-lzo
user nobody
group users
persist-key
persist-tun
status openvpn-status.log
verb 3
script-security 3
auth-user-pass-verify /etc/openvpn/auth-chap via-env
client-cert-not-required
duplicate-cn
management 127.0.0.1 51194

Any ideas what am I missing? I've tried quite a few things and searched a lot, there is simply no solution on the googleable internet.

share|improve this question

1 Answer 1

man openvpn:

--local
host Local host name or IP address for bind. If specified, OpenVPN will bind to this address only. If unspecified, OpenVPN will bind to all interfaces.

So, if you do not specify any "local" directive, openvpn server will listen on all interfaces. You can check this with netstat -nlp. You should see something like:

udp 0 0 0.0.0.0:1194 0.0.0.0:* LISTEN 2005/openvpn

Change protocol to tcp and try to connect to 1194 port for both addresses. If you have problems, error is somewhere in routing rules.

share|improve this answer
    
Selivanov Pavel, changing protocol to TCP works on both IPs without "local" statement in config. However when the config is set to UDP (the recommended protocol) is only working when I specify the IP with "local" statement. –  user2489483 Jun 16 '13 at 12:09
    
How to make it work via UDP on both IPs? It works for TCP but it does not allow connection on neither IP via UDP, unless I specify "local" statement in config. But with "local" I can only make it work on 1 IP and I need both IPs to accept connections. Thank you –  user2489483 Jun 16 '13 at 12:17
    
Why not just add an iptables rule to redirect packets to the correct IP? –  Zoredache Jun 16 '13 at 19:13
    
Show us netstat -nlp when openvpn server in udp mode is running. If it's OK, you have problems with routing. Possibly, server ansvers not from IP where it was asked.Try to configure two additional routing tables for both IPs and corresponding routing rules, like here –  Selivanov Pavel Jun 17 '13 at 20:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.