3

I'm newbie in network/routing subject and I'm doing my first VPN server. While reading my server.ovpn file, I saw the line:

server 10.1.0.0 255.255.255.0

So I though: looks like I can reach only 255 IPs assigning. I did some researchs in netmask concepts and my thinking looks right. To worse the scenario, I'm using net30 topology, which takes out 4 IPs per client, so 255/4 gives me 63 IPs only! When I startup the server, I see the following in logs:

Notified TAP-Windows driver to set a DHCP IP/netmask of 10.1.0.1/255.255.255.252 on interface

So I'm very confused about how it will behave when I start connecting clients there, I'll have a limit of 63 clients connected?

3
  • Is there a reason why you cannot adjust the netmask if you need to support more clients? Oct 12, 2014 at 15:45
  • I tried to put 255.0.0.0 and I got the error: Options error: --server directive network/netmask combination is invalid. Then I put 255.255.0.0 and it worked, but I still getting: Notified TAP-Windows driver to set a DHCP IP/netmask of 10.1.0.1/255.255.255.252 on interface on logs, so I'm not sure if changed something. Oct 12, 2014 at 16:41
  • Glueon is right, but to elaborate - this is because openvpn in it's default mode puts each client into its own subnet which has 4 ips. 1 for the server, 1 for the client, one for the network address and one for the broadcast. With 255 available you get ~63 clients max. It is possible with openvpn's 'topology subnet' server setting to put all clients into the same subnet which would let you have 253 clients on a single /24 subnet, but this isn't the default, nor recommended. It also means clients may be able to intercommunicate without firewall intervention by yourself.
    – Sirex
    Oct 12, 2014 at 19:23

1 Answer 1

2

You can replace:

server 10.1.0.0 255.255.255.0

With:

server 10.1.0.0 255.255.0.0

It's not possible to config OpenVPN with /8 subnet because that limit is hardcoded. In pool.h there is the IFCONFIG_POOL_MIN_NETBITS constant equal to 16. So subnet should be larger than /16.

11
  • OK I got you. But I still have a little question... I have 63 clients limit for IPs allocation. Let's suppose in one day I get this 63 clients connected in the server and the DHCP lease time is 1 year (default). If tomorrow I receive the 64º client (he didn't connected on the server so far), the server will recognize that he's a new client and allocate him into a IP address used yesterday by another user or will block connection because have no more IPs available for allocation? Oct 12, 2014 at 19:33
  • If you specify server 10.0.0.0 255.255.255.255 and subnet runs out of IPs OpenVPN will attempt to push default_gateway=10.0.2.2 and end up with: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options; OpenVPN ROUTE: failed to parse/resolve route for host/network: 10.0.0.1 errors. Also it seems you have 62 IP limit, because pool begins at 10.0.0.6 -> 10.0.0.5.
    – Glueon
    Oct 12, 2014 at 20:14
  • I still confused if after 63 clients allocation, when the 64 connect (after someone in the first 63 disconnect because I'm using max-clients 63) OpenVPN will allocate him in some old IP address used by another client OR if he will get error and no one else (besides the first 63) will connect to the server. If you can clarify this to me I would appreciate. Anyway I just accepted your answer. Thank you. Oct 12, 2014 at 21:27
  • @ user2864778 I used server 10.0.0.0 255.255.255.0 OpenVPN server and tried to connect 70 clients. At one point connections began giving the error I mentioned already. Tun device gets allocated but it does not get any IP. what will be in case of Windows I have no idea.
    – Glueon
    Oct 12, 2014 at 21:31
  • I'm using 10.8.0.0 255.255.0.0 in a Windows Server. But I'm not sure if this will solve the problem. And I'm very afraid of start using this server and after 63 clients no one gets in, even using the max-clients 63. Maybe after the first 63, the OpenVPN cannot alloc new clients on old IPs... Not sure. Oct 12, 2014 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .