0

I have a VPS with these public IP-addresses:

xx.xx.xx.192 (This IP-address is assigned to eth0)
xx.xx.xx.193
xx.xx.xx.194
xx.xx.xx.195
xx.xx.xx.196
xx.xx.xx.197
xx.xx.xx.198
xx.xx.xx.200
xx.xx.xx.201
xx.xx.xx.202

eth0 is configured with static IP. Gateway is xx.xx.xx.254, netmask is 255.255.255.0 ipv4_forward is 1. I have no iptables rules yet. This server is not standing behind a NAT-restricted network. (I don't need to open ports for services anywhere, just set up the service and connect to the server via the port.)

I want to make that the OpenVPN server assigns all the public IPs to the clients, except .192, of course.

But when I connect to the OpenVPN server, I does not get a IP-address. Windows just set IP-address to the 169.xx.xx.xx address (local only)

I tried to make the TAP-adapter to have a static IP-address, xx.xx.xx.194 with xx.xx.xx.192 as gateway, and 255.255.255.0 as netmask. Now I can't connect something with this IP. My computer tries to reach the destination with the TAP-adapter first, then it gives up and use my default network connection instead. (WLAN)

This is the config of OpenVPN server, do I miss something?

mode server

dev tap

port 1197

proto udp

local xx.xx.xx.192

tls-server

dh /etc/openvpn/ssl/dh1024.pem

cert /etc/openvpn/ssl/server.crt

key /etc/openvpn/ssl/server.key

ca /etc/openvpn/ssl/ca.crt

reneg-sec 216000

ifconfig xx.xx.xx.193 255.255.255.0

push "route xx.xx.xx.194 255.255.255.0 net_gateway"

push "route-gateway xx.xx.xx.192"

push "redirect-gateway def1"

push "dhcp-option DNS 195.159.0.100"

push "dhcp-option DNS 195.159.0.200"

keepalive 5 60

comp-lzo

user nobody

group nogroup

persist-key

persist-tun

log /var/log/openvpn/main204.log

verb 1

mute 10

username-as-common-name

tun-mtu 1500

tun-mtu-extra 32

max-clients 30

auth-user-pass-verify "/etc/openvpn/script/login.sh" via-env

script-security 3

tmp-dir "/tmp"

tcp-queue-limit 128

txqueuelen 200

tcp-nodelay

inactive 600

client-connect /etc/openvpn/script/connect.sh

client-disconnect /etc/openvpn/script/disconnect.sh

cipher aes-128-cbc

I'm using MySQL authentication, so this is the login.sh script:

//!/bin/bash

. /etc/openvpn/script/config.sh

//Authentication

user_id=$(mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -sN -e "select user_id from ovpnuser where user_id = '$username' AND user_pass = '$password' AND user_enable=1 AND user_start_date != user_end_d$

//Check user

[ "$user_id" != '' ] && [ "$user_id" = "$username" ] && echo "user : $username" && echo 'authentication ok.' && exit 0 || echo 'authentication failed.'; exit 1

This is connect.sh script:

//!/bin/bash

. /etc/openvpn/script/config.sh

//insert data connection to table log
mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -e "INSERT INTO ovpnlog (log_id,user_id,log_trusted_ip,log_trusted_port,log_remote_ip,log_remote_port,log_start_time,log_end_time,log_received,log_send) V$

//set status online to user connected

mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -e "UPDATE ovpnuser SET user_online=1 WHERE user_id='$common_name'"
2

You are using a tap-style interface. This will not be assigned an address by OpenVPN itself by default but is meant to be bridged into a current network, where the address will be assigned by the means used for address assignment in this network.

Apparently, you have not yet set up the bridging part yet, so if you want to continue with the tap-style setup, take a look at the bridging section in the OpenVPN documentation for an example of how this might look like.

Bear in mind though that TAP with bridging would create more overhead and noise from the clients' broadcast traffic and would be harder to filter, shape and troubleshoot compared to a tun setup.

Thus, I rather would recommend using a tun style interface in conjunction with either Proxy ARP (if you really need the public addresses assigned to your clients) or address translation (if it would be enough for the traffic to these addresses to be forwarded to your clients). Look at the "Handing out public IPs" section from the OpenVPN 2 cookbook for a simple example on how this is accomplished with proxy ARP - it basically uses ifconfig-pool together with topology subnet for client address assignment and a pair of client-connect / client-disconnect scripts managing ARP entries and host routes for connecting clients.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.