Dotaz: OpenVPN - Staticke prideleni ip adresy

[Michal54]

Ahoj, mam problem s OpenVPN, potrebuju staticky pridelovat Ip adresy

Pridal jsem do konfigurace serveru:

client-config-dir /etc/openvpn/ccd

a vytvoril soubor

/etc/openvpn/ccd/client1

ktery obsahuje

ifconfig-push 85.25.228.39 85.25.228.36

 

Client vsak dostava stale stejenou adresu 85.25.228.37

V logu o tom nejni ani zminka

 

Zkousel jsem take pridat volbu

ccd-exclusive

potom se klient nepripojil a v logu bylo

Mon Jun 15 14:42:53 2009 89.102.236.226:32966 TLS Auth Error: --client-config-dir authentication failed for common name 'client1' file='/etc/openvpn/ccd/client1'

prestoze tento soubor existuje

Zkousel jsem nastavit prava pouze ke cteni, ale take na 777 a nic nepomohlo

 

V cem jeste by mohl byt problem?

Dekuji

 

Odpovědi

[menphis]

zkus tam dat jen client-config-dir ccd

jinak klient se musi overovat klicem, ktery ma jmeno "client1"

[Michal54]

To jsem zkousl, vysledek je stejny

Zde je vypis me konfigurace

Server:

# server
mode server
tls-server
port 1194
proto tcp-server
dev tap0
ifconfig 85.25.228.36 255.255.255.0
ifconfig-pool 85.25.228.37 85.25.228.62 255.255.255.0
client-config-dir ccd
#ccd-exclusive
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
log-append /var/log/openvpn.log
status /var/run/vpn.status 10
user openvpn
group openvpn
verb 3
comp-lzo
keepalive 10 30

  Windows Klient:

# server ke kteremu se pripojujeme
remote 85.25.71.140
# tls jako klient
tls-client
# port, 1194 = default
port 1194
# protokol, tcp/udp
proto tcp-client
# nastaveni zarizeni
dev tap
# povoluje stazeni konfigurace ze severu
pull
# certifikat certifikacni autority
ca ca.crt
# certifikat klienta
cert client1.crt
# certifikat klienta
key client1.key
comp-lzo
verb 3
keepalive 10 30

vypis z logu:

Mon Jun 15 15:42:30 2009 OpenVPN 2.0.9 x86_64-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Sep 22 2007
Mon Jun 15 15:42:30 2009 WARNING: you are using user/group/chroot without persist-key/persist-tun -- this may cause restarts to fail
Mon Jun 15 15:42:30 2009 Diffie-Hellman initialized with 2048 bit key
Mon Jun 15 15:42:30 2009 TLS-Auth MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Jun 15 15:42:30 2009 TUN/TAP device tap0 opened
Mon Jun 15 15:42:30 2009 ifconfig tap0 85.25.228.36 netmask 255.255.255.0 mtu 1500 broadcast 85.25.228.255
Mon Jun 15 15:42:30 2009 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Jun 15 15:42:30 2009 GID set to openvpn
Mon Jun 15 15:42:30 2009 UID set to openvpn
Mon Jun 15 15:42:30 2009 Listening for incoming TCP connection on [undef]:1194
Mon Jun 15 15:42:30 2009 TCPv4_SERVER link local (bound): [undef]:1194
Mon Jun 15 15:42:30 2009 TCPv4_SERVER link remote: [undef]
Mon Jun 15 15:42:30 2009 MULTI: multi_init called, r=256 v=256
Mon Jun 15 15:42:30 2009 IFCONFIG POOL: base=85.25.228.37 size=26
Mon Jun 15 15:42:30 2009 MULTI: TCP INIT maxclients=1024 maxevents=1028
Mon Jun 15 15:42:30 2009 Initialization Sequence Completed
Mon Jun 15 15:42:34 2009 MULTI: multi_create_instance called
Mon Jun 15 15:42:34 2009 Re-using SSL/TLS context
Mon Jun 15 15:42:34 2009 LZO compression initialized
Mon Jun 15 15:42:34 2009 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Jun 15 15:42:34 2009 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Jun 15 15:42:34 2009 Local Options hash (VER=V4): '3e6d1056'
Mon Jun 15 15:42:34 2009 Expected Remote Options hash (VER=V4): '31fdf004'
Mon Jun 15 15:42:34 2009 TCP connection established with 89.102.236.226:32939
Mon Jun 15 15:42:34 2009 TCPv4_SERVER link local: [undef]
Mon Jun 15 15:42:34 2009 TCPv4_SERVER link remote: 89.102.236.226:32939
Mon Jun 15 15:42:34 2009 89.102.236.226:32939 TLS: Initial packet from 89.102.236.226:32939, sid=d3ba13be 8d6ac4ce
Mon Jun 15 15:42:35 2009 89.102.236.226:32939 VERIFY OK: depth=1, /C=US/ST=NA/L=CITY/O=OpenVPN/emailAddress=riddler2riddler@hotmail.com
Mon Jun 15 15:42:35 2009 89.102.236.226:32939 VERIFY OK: depth=0, /C=US/ST=NA/O=OpenVPN/OU=NONE/CN=client1/emailAddress=riddler2riddler@hotmail.com
Mon Jun 15 15:42:36 2009 89.102.236.226:32939 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 15 15:42:36 2009 89.102.236.226:32939 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 15 15:42:36 2009 89.102.236.226:32939 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jun 15 15:42:36 2009 89.102.236.226:32939 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 15 15:42:36 2009 89.102.236.226:32939 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jun 15 15:42:36 2009 89.102.236.226:32939 [client1] Peer Connection Initiated with 89.102.236.226:32939
Mon Jun 15 15:42:37 2009 client1/89.102.236.226:32939 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jun 15 15:42:37 2009 client1/89.102.236.226:32939 SENT CONTROL [client1]: 'PUSH_REPLY,ping 10,ping-restart 30,ifconfig 85.25.228.37 255.255.255.0' (status=1)
Mon Jun 15 15:42:42 2009 client1/89.102.236.226:32939 MULTI: Learn: 00:ff:50:2a:02:21 -> client1/89.102.236.226:32939

 

 

[the.max]

# cat /etc/openvpn/openvpn.conf
dev tap0
proto tcp-server
port 1194

mode server
tls-server

ifconfig 172.20.0.1 255.255.255.0
ifconfig-pool 172.20.0.2 172.20.0.254 255.255.255.0
ifconfig-pool-persist /etc/openvpn/openvpn.ip_pool.txt 

dh /etc/openvpn/klyce/dh1024.pem
ca /etc/openvpn/klyce/ca.crt
cert /etc/openvpn/klyce/server.crt
key /etc/openvpn/klyce/server.key

log /var/log/openvpn.log
verb 3
status /var/run/openvpn.status 10

user nobody
group nogroup

persist-key
persist-tun
keepalive 10 30
client-to-client
max-clients 64

up ./openvpn.up
down ./openvpn.down

# cat /etc/openvpn/openvpn.ip_pool.txt
tik_bilina,172.20.0.2

[bow]

WTF "klyce" ?

[Víťa]

nepovažuji se za odborníka na openvpn a možná už to máš vyřešené, nicméně jsem koukl jak to je na našem serveru a potom co máš tady v klientských souborech ccd/client1 a zdá se mi, že v ifconfig-push by měla být na 2. místě maska, ty tam máš Ip adresu. (ifconfig-push 85.25.228.39 85.25.228.36)