1

I have OpenVPN setup and running correctly. The problem is I want to assign static IPs to certain users on my VPN, so they always get the exact same IP every time.

My setup is for PAM authentication, this is working fine:

client-cert-not-required
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login

My username is joel and also it is working fine as I can login to the VPN from any PC using this username. Here is my server.conf file for IP static config:

client-config-dir /etc/openvpn/ccd

CCD Directory and the User file are both owned by nobody as my process runs as them:

enter image description here enter image description here

Contents of the user file:

enter image description here

Even with all of this I still do not have a static IP when I connect as user joel. I get different IPs everytime, from .6 to .10, but never .4.

1
  • 1
    What are you using for your topology? Is this tun or tap? Do you have old Windows clients connecting to this system? Does your config have username-as-common-name set?
    – Zoredache
    Apr 23, 2015 at 19:01

2 Answers 2

2

First, do you have a client-connect script in place? If so, any IP directives from that take precedence.

Secondly, according to the OpenVPN documentation, the client-config-dir only uses the client's X.509 common name to determine which file to use. You can validate if the joel file is not matching by creating a DEFAULT file. It appears that you are not using client certificates at all, which may preclude the use of the client-config-dir option.

1
  • Thanks for that! It was just what I needed, I didn't know that I had to tell OpenVPN to set the Common Name to username, I thought it already did. Using username-as-common-name on server side did it.
    – jfreak53
    Apr 23, 2015 at 19:01
2

Using username/password authentication disables any Common Name use by OpenVPN. So it doesn't set the client Common name when logging in.

The solution is to set the following flag in the server.conf file and restart the OpenVPN server:

username-as-common-name

This tells OpenVPN to set the username to the client's Common Name when connecting. Since the file is named after Common Name this is required or OpenVPN doesn't know which file to check.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .