Pfsense 2.3 static client IP



  • hi
    I am having a heck of trouble getting a static IP out to clients with OPEN VPN in the current version
    Seems to just want to allocate IPs from the  Server IPv4 Tunnel Network /24 but ignores the Client  IPv4 Tunnel Network /30.
    A topology of "net30" is set on both the server and the client.
    In this case the client is getting an IP of 10.10.10.6

    Any ideas?

    Below are the configs generated from the interface:

    Shell Output - cat /var/etc/openvpn/server1.conf

    dev ovpns1
    verb 1
    dev-type tun
    dev-node /dev/tun1
    writepid /var/run/openvpn_server1.pid
    #user nobody
    #group nobody
    script-security 3
    daemon
    keepalive 10 60
    ping-timer-rem
    persist-tun
    persist-key
    proto udp
    cipher AES-256-CBC
    auth SHA1
    up /usr/local/sbin/ovpn-linkup
    down /usr/local/sbin/ovpn-linkdown
    local the.VPN.ip4.address
    tls-server
    server 10.10.10.0 255.255.255.0
    client-config-dir /var/etc/openvpn-csc/server1
    tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'ovpn-1-server' 1"
    lport 1194
    management /var/etc/openvpn/server1.sock unix
    push "route 172.28.1.0 255.255.255.0"
    ca /var/etc/openvpn/server1.ca
    cert /var/etc/openvpn/server1.cert
    key /var/etc/openvpn/server1.key
    dh /etc/dh-parameters.2048
    tls-auth /var/etc/openvpn/server1.tls-auth 0
    comp-lzo adaptive
    passtos
    topology net30

    Shell Output - cat /var/etc/openvpn/client4.conf

    dev ovpnc4
    verb 1
    dev-type tun
    dev-node /dev/tun4
    writepid /var/run/openvpn_client4.pid
    #user nobody
    #group nobody
    script-security 3
    daemon
    keepalive 10 60
    ping-timer-rem
    persist-tun
    persist-key
    proto udp
    cipher AES-256-CBC
    auth SHA1
    up /usr/local/sbin/ovpn-linkup
    down /usr/local/sbin/ovpn-linkdown
    local the.WAN.ip.address
    tls-client
    client
    lport 0
    management /var/etc/openvpn/client4.sock unix
    remote the.VPN.ip4.address 1194
    ifconfig 10.10.10.10 10.10.10.9
    ca /var/etc/openvpn/client4.ca
    cert /var/etc/openvpn/client4.cert
    key /var/etc/openvpn/client4.key
    tls-auth /var/etc/openvpn/client4.tls-auth 1
    comp-lzo adaptive
    passtos
    resolv-retry infinite



  • Hi,

    Same goes to me. Still unable to set static IP for my openvpn client. I did follow what shown on the website but seems not working though.

    https://fastinetserver.wordpress.com/2013/03/09/pfsense-openvpn-static-ip-for-clients/

    any other ideas? :'(



  • using a client specific override was the way it used to work in version <2.3 - as per your link - and that method used to work ok.



  • @MRH:

    using a client specific override was the way it used to work in version <2.3 - as per your link - and that method used to work ok.

    are those method work for windows client also?


  • LAYER 8 Global Moderator

    what is not working? This is pretty straight forward…  So you see my client got 10.0.8.2, I then added an override all I put in was the clients CN and in the advanced tab did a push for the IP and mask..

    And bingo that is what it got... Why are you wanting to use net 30??  If your wanting to set a specific IP?




  • @johnpoz:

    what is not working? This is pretty straight forward…  So you see my client got 10.0.8.2, I then added an override all I put in was the clients CN and in the advanced tab did a push for the IP and mask..

    And bingo that is what it got... Why are you wanting to use net 30??  If your wanting to set a specific IP?

    I dont know which step im doing it wrong. but as i know i followed it correctly.




  • Maybe this will help someone:

    I have a client specific override to give a static IP to a contractor and it was working great with pfsense 2.2.6.  We just upgraded to 2.3.0 and it broke my client specific override, but everyone else was connecting just fine.  The VPN client was giving this error:

    ERROR: –ip-win32 dynamic [offset] : offset is outside of –ifconfig subnet

    The solution was to change the way I pushed the static IP.  What USED to work was this (under advanced settings in the CSO):

    ifconfig-push 10.40.5.242 10.40.5.241

    After the upgrade this no longer works.  What does seem to work is changing the setting to this:

    ifconfig-push 10.40.5.242 255.255.255.0

    I'm not a networking professional, I just wear the IT hat when something has to be done so I'm not sure if this is a good or bad thing to do, but it eliminated the error above and my client now gets a static IP like they used to.



  • For fixed client ip with ver 2.3  (in this example client  10.10.10.10) adding client specific override

    Tunnel network:
    10.10.10.8/30

    Advanced:
    ifconfig-push 10.10.10.10 255.255.255.252

    works ok.

    Was hoping this was covered in the originally generated config which had ifconfig 10.10.10.10 10.10.10.9 - without needing the additional override.



  • @SometimesAdmin:

    Maybe this will help someone:

    I have a client specific override to give a static IP to a contractor and it was working great with pfsense 2.2.6.  We just upgraded to 2.3.0 and it broke my client specific override, but everyone else was connecting just fine.  The VPN client was giving this error:

    ERROR: –ip-win32 dynamic [offset] : offset is outside of –ifconfig subnet

    The solution was to change the way I pushed the static IP.  What USED to work was this (under advanced settings in the CSO):

    ifconfig-push 10.40.5.242 10.40.5.241

    After the upgrade this no longer works.  What does seem to work is changing the setting to this:

    ifconfig-push 10.40.5.242 255.255.255.0

    I'm not a networking professional, I just wear the IT hat when something has to be done so I'm not sure if this is a good or bad thing to do, but it eliminated the error above and my client now gets a static IP like they used to.

    no luck for me  :'( . still failed to do so. btw how do you get that error message? using "Show Status" on client openvpn gui?



  • It's in the log file on the client.  On Windows, you can right-click the OpenVPN client icon and select view log.  You can change the logging level in the config file.



  • based on my log. everything seem fine.  :'(



Log in to reply