Can the inet address assigned to P-t-P tun interface be used for a client inet address if the server runs out of all addresses within a subnet?

Question

I have an OpenVPN server with an Inet address 10.8.0.1 serving the subnet 10.8.0.0/24. I have two clients connected to this server and the status log (/etc/openvpn/openvpn-status.log)reads as follows:

OpenVPN CLIENT LIST
Updated,Wed Aug  9 15:56:38 2017
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client1,10.0.0.177:54810,4648,4853,Wed Aug  9 15:56:28 2017
client2,10.0.0.224:53999,4731,4935,Wed Aug  9 15:56:16 2017
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.6,client1,10.0.0.177:54810,Wed Aug  9 15:56:28 2017
10.8.0.10,client2,10.0.0.224:53999,Wed Aug  9 15:56:16 2017
GLOBAL STATS
Max bcast/mcast queue length,0
END

Now, on client 2 when I run (ifconfig) I get the following for the tun interface:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

The P-t-P inet address reads 10.8.0.9. Where is this interface present in the subnet? Is it in the client or the server? Traceroute on this interface from the client gives me the following:

traceroute to 10.8.0.9 (10.8.0.9), 64 hops max
  1   10.8.0.1  0.348ms  0.210ms  0.163ms
  2   *  *  *
  3   *  *  *
  4   *  *  *
  5   * ^C

Now, if this is like a dummy inet address, can this inet address be used for a client by the OpenVPN server if it runs out of addresses in case it reaches a limit of 254 VPN clients?

Thanks in advance!

Zoredache · Answer 1 · 2017-08-09T17:35:06.013

Your OpenVPN server seems to be setup using the topology net30. This topology is required for compatibility with really old clients running on older versions of Windows.

This topology basically takes the that /24 subnet you assigned to the VPN and breaks it up into 64 subnets with 30 bit masks. Meaning you can have at most 63 connected clients.

In the net30, the 00 (binary bits), and 11 addresses are unused, the 01 address is assigned to the PTP connect on the server and the 10 address is used on the client.

So given the 10.8.0.6,client1,... client. the subnet is 10.8.0.4. The broadcast address is 10.8.0.7. The address that belongs to the OpenVPN server is 10.8.0.5 (though you won't actually see it assigned on the server), and the address assigned to the client is 10.8.0.6.

$ ipcalc 10.8.0.4/30

Address:   10.8.0.4             00001010.00001000.00000000.000001 00
Netmask:   255.255.255.252 = 30 11111111.11111111.11111111.111111 00
Wildcard:  0.0.0.3              00000000.00000000.00000000.000000 11
=>
Network:   10.8.0.4/30          00001010.00001000.00000000.000001 00
HostMin:   10.8.0.5             00001010.00001000.00000000.000001 01
HostMax:   10.8.0.6             00001010.00001000.00000000.000001 10
Broadcast: 10.8.0.7             00001010.00001000.00000000.000001 11

These days you would be far better off switching your server to use topology subnet. This option tells OpenVPN 10.8.0.0/24 as one single subnet and not to break it up into a bunch of smaller subnets. Each client will only consume 1 address from the potential ~253 available in the subnet instead of basically 4, which happens with the net30.

https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

topology mode

Configure virtual addressing topology when running in --dev tun mode. This directive has no meaning in --dev tap mode, which always uses a subnet topology. If you set this directive on the server, the --server and --server-bridge directives will automatically push your chosen topology setting to clients as well. This directive can also be manually pushed to clients. Like the --dev directive, this directive must always be compatible between client and server.

mode can be one of:

net30 -- Use a point-to-point topology, by allocating one /30 subnet per client. This is designed to allow point-to-point semantics when some or all of the connecting clients might be Windows systems. This is the default on OpenVPN 2.0.

subnet -- Use a subnet rather than a point-to-point topology by configuring the tun interface with a local IP address and subnet mask, similar to the topology used in --dev tap and ethernet bridging mode. This mode allocates a single IP address per connecting client and works on Windows as well. Only available when server and clients are OpenVPN 2.1 or higher, or OpenVPN 2.0.x which has been manually patched with the --topology directive code. When used on Windows, requires version 8.2 or higher of the TAP-Win32 driver. When used on *nix, requires that the tun driver supports an ifconfig(8) command which sets a subnet instead of a remote endpoint IP address.

Thank you! Appreciate the answer. Can you also elaborate if in the example cited by you, 10.8.0.5 could possibly be assigned to a client if the server reaches its quota of all available inet addresses in the subnet? (Assuming I use topology subnet) — Arjun Balakrishnan, Aug 09 '17 at 17:41
`10.8.0.5 could possibly be assigned to a client`. No that is not possible in the net30 topology. That address **is being used** in the point-to-point. — Zoredache, Aug 09 '17 at 18:08

Can the inet address assigned to P-t-P tun interface be used for a client inet address if the server runs out of all addresses within a subnet?

1 Answers1