1

I've set up a functioning OpenVPN net (with routing)... everything works but the IP reservation. I've a "special" client certificate associated with a IP reservation on my server. I did all the configs: created the ccd folder with the CN of the client file in it and edited the ipp file. Still, when I try to connect to my VPN, my server always gives different IPs to my client. How is that possible? Thank you very much!

Server Configuration:

# Which local IP address should OpenVPN
# listen on? (optional)
local 192.168.1.2

# Port listening on:
port 1194

# TCP or UDP server?
proto udp

dev tun

# Certs:

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key

# Diffie hellman parameters.

dh /etc/openvpn/dh2048.pem

# VPN Subnet:
server 10.2.1.0 255.255.255.0

# Static IPs:
ifconfig-pool-persist ipp.txt

# Client Custom Config Dir:
client-config-dir /etc/openvpn/ccd

# Tunneling traffic through VPN:
push "redirect-gateway"

# Push (Windows-Specific) DNS:
push "dhcp-option DNS 8.8.8.8"

# Clients will be able to contact each other:
client-to-client

# The Server will accept clients with the same certificate:
duplicate-cn

# Pings every 300 seconds and wait 900 seconds for a response (to keep alive the connection):
keepalive 300 900

# Compression:
comp-lzo

# Privilege downgrade: (Linux Specific)
user nobody
group nobody

persist-key
persist-tun

# Quick Log:
status openvpn-status.log

# Logs:
log         openvpn.log
log-append  openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

# Pushing Routes:

route 10.2.1.0 255.255.255.0
push "route 10.2.2.0 255.255.255.0"

Client Configuration:

# Configuration Type:
client

# Device Type:
dev tun

# Protocol:
proto udp

# VPN Server IP:
remote X 1194

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
user nobody
group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
mute-replay-warnings

# Certs:
ca ca.crt
cert crt.crt
key key.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". 
ns-cert-type server

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3
peperunas
  • 125
  • 10
  • 2
    Show your configuration. – Michael Hampton Jul 14 '13 at 20:50
  • Check your file and directory permissions. If your OpenVPN server is not running as root (recommended), then the openvpn user must be able to read the client-specific configuration (which must match the Common Name on your client cert). If these permissions are incorrect, then OpenVPN silently ignores the files. – Lekensteyn Jul 14 '13 at 22:24
  • I've already checked the permissions (for user nobody). How can I check the Common Name of my client certificate (just to be sure I didn't do an error..) – peperunas Jul 15 '13 at 07:26

1 Answers1

1

Editing the file specified by ifconfig-pool-persist is not the correct way to set a permanent static address for a host.

If you want to issue an address permanently a better solution is to use the ifconfig-push local remote directive in the client config file for that host.

Zoredache
  • 130,897
  • 41
  • 276
  • 420
  • Local shoud be my "preferred IP" right? Remote however? How can I be sure that my server has the "remote" IP I specified? But what happens if my IP is already taken? – peperunas Jul 14 '13 at 21:25
  • What you use for the 'local remote' are extremely defendant on how you have OpenVPN configured. There are many modes, and the values you use are different for each mode. If you had taken Michael Hampton's suggestion and actually added more details like your current config. I might have been able to add an example. – Zoredache Jul 15 '13 at 06:54
  • Ok, I've added my configurations. – peperunas Jul 15 '13 at 07:44