1 |
On 02/25/10 08:40, Xavier Parizet wrote: |
2 |
>On 02/25/2010 02:32 AM, Joseph wrote: |
3 |
>> I've configured OpenVPN and it works OK but I can not seems to figure it |
4 |
>> out how to assign static IP to clients |
5 |
>> |
6 |
>> My server.conf port 8458 |
7 |
>> proto udp |
8 |
>> dev tun |
9 |
>> mode server |
10 |
>> ca /usr/share/openvpn/easy-rsa/keys/ca.crt |
11 |
>> cert /usr/share/openvpn/easy-rsa/keys/server.crt |
12 |
>> key /usr/share/openvpn/easy-rsa/keys/server.key |
13 |
>> dh /usr/share/openvpn/easy-rsa/keys/dh1024.pem |
14 |
>> server 192.168.139.0 255.255.255.0 |
15 |
>> client-to-client |
16 |
>> ifconfig-pool-persist ipp.txt |
17 |
>> client-config-dir ccd |
18 |
>> keepalive 10 120 |
19 |
>> tls-auth vpn_my.key 0 |
20 |
>> tun-mtu 1500 |
21 |
>> tun-mtu-extra 32 |
22 |
>> mssfix 1200 |
23 |
>> duplicate-cn |
24 |
>> comp-lzo |
25 |
>> max-clients 100 |
26 |
>> persist-key |
27 |
>> persist-tun |
28 |
>> status openvpn-status.log |
29 |
>> log /var/log/openvpn.log |
30 |
>> log-append /var/log/openvpn.log |
31 |
>> verb 3 |
32 |
>> |
33 |
>> On client in /etc/openvpn/ccd directory I've created a file "syscon9" with: |
34 |
>> ifconfig-push 192.168.139.15 192.168.139.1 |
35 |
> |
36 |
>Hmmm... 192.168.139.1 does not seem a remote netmask, isn't it ? |
37 |
>man openvpn tell me the following for ifconfig-push: |
38 |
>--ifconfig-push local remote-netmask |
39 |
> |
40 |
>so, put ifconfig-push 192.168.139.15 255.255.255.0 rather than the line |
41 |
>above in the ccd directory. |
42 |
> |
43 |
>If it doesn't work, then please post the openvpn.log of the client. |
44 |
|
45 |
I've tried it many time, it doesn't work with the netmaks. |
46 |
File: syscon9 from ccd: |
47 |
cat syscon9 |
48 |
ifconfig-push 192.168.0.15 255.255.255.0 |
49 |
|
50 |
log file from the client: |
51 |
cat /var/log/openvpn.log |
52 |
Thu Feb 25 09:47:17 2010 OpenVPN 2.1_rc15 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Jan 16 2010 |
53 |
Thu Feb 25 09:47:17 2010 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts |
54 |
Thu Feb 25 09:47:17 2010 Control Channel Authentication: using '/etc/openvpn/client_clinic2/vpn_my.key' as a OpenVPN static key file |
55 |
Thu Feb 25 09:47:17 2010 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication |
56 |
Thu Feb 25 09:47:17 2010 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication |
57 |
Thu Feb 25 09:47:17 2010 LZO compression initialized |
58 |
Thu Feb 25 09:47:17 2010 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ] |
59 |
Thu Feb 25 09:47:17 2010 Data Channel MTU parms [ L:1574 D:1200 EF:42 EB:135 ET:32 EL:0 AF:3/1 ] |
60 |
Thu Feb 25 09:47:17 2010 Local Options hash (VER=V4): 'ec497616' |
61 |
Thu Feb 25 09:47:17 2010 Expected Remote Options hash (VER=V4): '7cd8ed90' |
62 |
Thu Feb 25 09:47:17 2010 Socket Buffers: R=[114688->131072] S=[114688->131072] |
63 |
Thu Feb 25 09:47:17 2010 UDPv4 link local: [undef] |
64 |
Thu Feb 25 09:47:17 2010 UDPv4 link remote: 208.38.31.237:9000 |
65 |
Thu Feb 25 09:47:17 2010 TLS: Initial packet from 208.38.31.237:9000, sid=7d5fc404 0c60dcb5 |
66 |
Thu Feb 25 09:47:17 2010 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@××××××.mydomain |
67 |
Thu Feb 25 09:47:17 2010 Validating certificate key usage |
68 |
Thu Feb 25 09:47:17 2010 ++ Certificate has key usage 00a0, expects 00a0 |
69 |
Thu Feb 25 09:47:17 2010 VERIFY KU OK |
70 |
Thu Feb 25 09:47:17 2010 Validating certificate extended key usage |
71 |
Thu Feb 25 09:47:17 2010 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication |
72 |
Thu Feb 25 09:47:17 2010 VERIFY EKU OK |
73 |
Thu Feb 25 09:47:17 2010 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@××××××.mydomain |
74 |
Thu Feb 25 09:47:18 2010 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key |
75 |
Thu Feb 25 09:47:18 2010 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication |
76 |
Thu Feb 25 09:47:18 2010 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key |
77 |
Thu Feb 25 09:47:18 2010 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication |
78 |
Thu Feb 25 09:47:18 2010 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA |
79 |
Thu Feb 25 09:47:18 2010 [server] Peer Connection Initiated with 208.38.31.237:9000 |
80 |
Thu Feb 25 09:47:19 2010 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) |
81 |
Thu Feb 25 09:47:19 2010 PUSH: Received control message: 'PUSH_REPLY,route 192.168.139.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig |
82 |
192.168.139.10 192.168.139.9' |
83 |
Thu Feb 25 09:47:19 2010 OPTIONS IMPORT: timers and/or timeouts modified |
84 |
Thu Feb 25 09:47:19 2010 OPTIONS IMPORT: --ifconfig/up options modified |
85 |
Thu Feb 25 09:47:19 2010 OPTIONS IMPORT: route options modified |
86 |
Thu Feb 25 09:47:19 2010 ROUTE default_gateway=10.0.0.1 |
87 |
Thu Feb 25 09:47:19 2010 TUN/TAP device tun0 opened |
88 |
Thu Feb 25 09:47:19 2010 TUN/TAP TX queue length set to 100 |
89 |
Thu Feb 25 09:47:19 2010 /sbin/ifconfig tun0 192.168.139.10 pointopoint 192.168.139.9 mtu 1500 |
90 |
Thu Feb 25 09:47:19 2010 /etc/openvpn/up.sh tun0 1500 1574 192.168.139.10 192.168.139.9 init |
91 |
Thu Feb 25 09:47:19 2010 /sbin/route add -net 192.168.139.0 netmask 255.255.255.0 gw 192.168.139.9 |
92 |
Thu Feb 25 09:47:19 2010 Initialization Sequence Completed |
93 |
|
94 |
I got ip 192.168.139.10 not the 192.168.139.15 as requested in "ifconfig-push" |
95 |
|
96 |
-- |
97 |
Joseph |