Pfsense 2.3 static client IP

MRH

hi
I am having a heck of trouble getting a static IP out to clients with OPEN VPN in the current version
Seems to just want to allocate IPs from the Server IPv4 Tunnel Network /24 but ignores the Client IPv4 Tunnel Network /30.
A topology of "net30" is set on both the server and the client.
In this case the client is getting an IP of 10.10.10.6

Any ideas?

Below are the configs generated from the interface:

Shell Output - cat /var/etc/openvpn/server1.conf

dev ovpns1
verb 1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local the.VPN.ip4.address
tls-server
server 10.10.10.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server1
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'ovpn-1-server' 1"
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 172.28.1.0 255.255.255.0"
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.2048
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo adaptive
passtos
topology net30

Shell Output - cat /var/etc/openvpn/client4.conf

dev ovpnc4
verb 1
dev-type tun
dev-node /dev/tun4
writepid /var/run/openvpn_client4.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local the.WAN.ip.address
tls-client
client
lport 0
management /var/etc/openvpn/client4.sock unix
remote the.VPN.ip4.address 1194
ifconfig 10.10.10.10 10.10.10.9
ca /var/etc/openvpn/client4.ca
cert /var/etc/openvpn/client4.cert
key /var/etc/openvpn/client4.key
tls-auth /var/etc/openvpn/client4.tls-auth 1
comp-lzo adaptive
passtos
resolv-retry infinite

hazly92

Hi,

Same goes to me. Still unable to set static IP for my openvpn client. I did follow what shown on the website but seems not working though.

https://fastinetserver.wordpress.com/2013/03/09/pfsense-openvpn-static-ip-for-clients/

any other ideas? :'(

MRH

using a client specific override was the way it used to work in version <2.3 - as per your link - and that method used to work ok.

hazly92

@MRH:

using a client specific override was the way it used to work in version <2.3 - as per your link - and that method used to work ok.

are those method work for windows client also?

johnpoz

what is not working? This is pretty straight forward… So you see my client got 10.0.8.2, I then added an override all I put in was the clients CN and in the advanced tab did a push for the IP and mask..

And bingo that is what it got... Why are you wanting to use net 30?? If your wanting to set a specific IP?

clientoverride.png_thumb

hazly92

@johnpoz:

what is not working? This is pretty straight forward… So you see my client got 10.0.8.2, I then added an override all I put in was the clients CN and in the advanced tab did a push for the IP and mask..

And bingo that is what it got... Why are you wanting to use net 30?? If your wanting to set a specific IP?

I dont know which step im doing it wrong. but as i know i followed it correctly.

failed.JPG_thumb

SometimesAdmin

Maybe this will help someone:

I have a client specific override to give a static IP to a contractor and it was working great with pfsense 2.2.6. We just upgraded to 2.3.0 and it broke my client specific override, but everyone else was connecting just fine. The VPN client was giving this error:

ERROR: –ip-win32 dynamic [offset] : offset is outside of –ifconfig subnet

The solution was to change the way I pushed the static IP. What USED to work was this (under advanced settings in the CSO):

ifconfig-push 10.40.5.242 10.40.5.241

After the upgrade this no longer works. What does seem to work is changing the setting to this:

ifconfig-push 10.40.5.242 255.255.255.0

I'm not a networking professional, I just wear the IT hat when something has to be done so I'm not sure if this is a good or bad thing to do, but it eliminated the error above and my client now gets a static IP like they used to.

MRH

For fixed client ip with ver 2.3 (in this example client 10.10.10.10) adding client specific override

Tunnel network:
10.10.10.8/30

Advanced:
ifconfig-push 10.10.10.10 255.255.255.252

works ok.

Was hoping this was covered in the originally generated config which had ifconfig 10.10.10.10 10.10.10.9 - without needing the additional override.

hazly92

@SometimesAdmin:

Maybe this will help someone:

I have a client specific override to give a static IP to a contractor and it was working great with pfsense 2.2.6. We just upgraded to 2.3.0 and it broke my client specific override, but everyone else was connecting just fine. The VPN client was giving this error:

ERROR: –ip-win32 dynamic [offset] : offset is outside of –ifconfig subnet

The solution was to change the way I pushed the static IP. What USED to work was this (under advanced settings in the CSO):

ifconfig-push 10.40.5.242 10.40.5.241

After the upgrade this no longer works. What does seem to work is changing the setting to this:

ifconfig-push 10.40.5.242 255.255.255.0

I'm not a networking professional, I just wear the IT hat when something has to be done so I'm not sure if this is a good or bad thing to do, but it eliminated the error above and my client now gets a static IP like they used to.

no luck for me :'( . still failed to do so. btw how do you get that error message? using "Show Status" on client openvpn gui?

SometimesAdmin

It's in the log file on the client. On Windows, you can right-click the OpenVPN client icon and select view log. You can change the logging level in the config file.

hazly92

based on my log. everything seem fine. :'(

log.JPG_thumb