OpenVPN without Static IP on WAN

trikedik · May 8, 2020, 4:25 PM

Hello all. I am having an issue with my OpenVPN where, when our internet goes down and we are given a new IP Address from our ISP, my OpenVPN server is no longer accessible to the clients. I know this is because the client needs to change their configuration to the new IP Address, but I am looking for a way around this, and without having to get a Static IP to put on my WAN interface. My OpenVPN is set to use the WAN interface, but when the WAN IP changes I have to change all my clients configurations to use the new IP.

I did see where someone said you can set the OpenVPN interface to localhost and then create a rule to point to the WAN IP, but I don't understand how the client configuration will know how to route to such a setup (ie, what value I would put in for Remote Server on my clients configuration). I guess my question is, which interface and rules do I need to use to set up OpenVPN so that when our WAN address changes, the clients can still connect without me having to change their configuration files? Is it possible to do this without a Static IP on the WAN interface?

Thank you in advance, any help on this matter is much appreciated.

Rico · May 8, 2020, 4:26 PM

Use DynDNS and your problem is solved. :-)

-Rico

Rico · May 8, 2020, 4:27 PM

I can recommend https://freedns.afraid.org/
It‘s free and very stable.

-Rico

johnpoz · May 8, 2020, 4:29 PM

^ exactly just use a ddns for your wan address in your openvpn client config.. The one listed is just 1 of many!! you could choose from..

trikedik · May 8, 2020, 4:32 PM

Thank you for the help on this, I will look into using DynDNS. Seems like just the solution I am looking for! Thanks!

JKnott · May 8, 2020, 6:29 PM

@trikedik

Also, you can see if your host name is permanent, even though the IP address changes. For example, I have a cable modem and a DHCP IPv4 address. The address is virtually static, but the host name, which is based on the firewall and modem MACs never changes, unless I change the hardware. It's a long host name, but perfectly suitable for configuring the VPN.

johnpoz · May 8, 2020, 6:33 PM

That is odd, can you give say a template of your name your using..

For example this is more normal
d53-64-x-x.nap.wideopenwest.com.

Where that take on the IP address..

JKnott · May 8, 2020, 6:49 PM

@johnpoz

Here is my IPv4 host name. I've changed some of the characters, to protect the guilty.

CPE0014d12bedfb-CMbc4dfc82e5e0.cpe.net.cable.rogers.com

The CPE is the firewall part of the host name and CM is the cable modem. So, my host name is CPE<firewall MAC>-CM<cable modem MAC>.cpe.net.cable.rogers.com. I get this by running the host command on my firewall IPv4 address.

johnpoz · May 8, 2020, 6:50 PM

really that is odd ;) nifty! Yeah something like that would work.

JKnott · May 8, 2020, 6:50 PM

@johnpoz

Well, it's not that odd. Everyone on Rogers has the same and I've talked to people on other ISPs that have similar. The common factor appears to be cable modems.

trikedik · May 9, 2020, 3:30 PM

I've never heard of this, thank you for the tip!

JKnott · May 9, 2020, 5:38 PM

@trikedik

So, all you have to do is open a command prompt in pfSense and use the host command, with your WAN address, to see what your host name is. You can do the same in Windows with nslookup.

JKnott · May 9, 2020, 8:58 PM

@johnpoz

One thing I did was create a public DNS alias to that long name to something much shorter and in my own domain.

johnpoz · May 9, 2020, 9:19 PM

Never seen such a ptr setup..

I am on cable internet.. And mine comes back like I showed..

[2.4.5-RELEASE][admin@sg4860.local.lan]/root: host 64.53.x.x
x.x.53.64.in-addr.arpa domain name pointer d53-64-x-x.nap.wideopenwest.com.

And every other cable provider I have ever used, for many many years ;)

JKnott · May 9, 2020, 9:20 PM

@johnpoz

I have seen the IP address included in the name, with ADSL in my area

johnpoz · May 9, 2020, 9:21 PM

I mean the setup makes sense with use of the cpe mac, and its clients.. Just never seen it before - for sure could come in handy.. Since tied to your mac like that, even if your IP changes should be viable to use... Wonder why more cable isps don't set it up? Or maybe they do but its only internal?

JKnott · May 9, 2020, 9:35 PM

@johnpoz

I really don't know why some companies do certain things and sometimes I wonder if they do. However, as I said, Rogers is not alone in this, but it is a good idea. I recall people I know complaining how their ADSL address would change, right in the middle of them doing something. I get the impression some ISPs are nasty.

I discovered this feature at least 15 years ago. Of course, when I change hardware, I have to update the DNS alias. I'm not certain what will happen with my IPv6 host names, as I haven't changed any hardware in the 4 years I've been getting IPv6 from my ISP. I'm assuming the DUID will keep the prefix from changing.