Ttyjfyk

I have an OpenVPN server running on a Linux Ubuntu box. Multiple clients connect to this server (500+) and that is why I set the server-bridge option like this:

server-bridge 10.0.100.1 255.255.0.0 10.0.200.1 10.0.210.254

This works perfectly. The clients get a dynamic IP address, and it goes from the 200 block to the 201 block when the number of client exceed 255.

I have an internal application that connects to these clients, but this application crashes on IP addresses 10.0.200.255 and 10.0.201.0.

These IP addresses are in the range I supplied, but I can't use them.

Is there a way to exclude them from my pool?

Or do I need change my setup?

Using multiple IP ranges or excluding certain IPs is not directly possible with OpenVPN's built-in DHCP server using a single configuration file.

I propose 3 possible solutions:

• 
  Workaround, but not guaranteed to work


• 
  DHCP-proxy mode, simple, clean and lots of other options


• 
  Multiple instances, more complex, could have performance benefits

However, I recommend to fix the root cause of the problem, the internal application that is flawed.

Workaround

In the server configuration file add:

server-bridge 10.0.100.1 255.255.0.0 10.0.200.1 10.0.210.254
ifconfig-pool-persist ipp.txt 0

The 0 at the end of the directive ifconfig-pool-persist treats ipp.txt as a read-only configuration file.

Create a file /etc/openvpn/ipp.txt:

reserved-not-used-cn-1,10.0.200.255
reserved-not-used-cn-2,10.0.201.0
reserved-not-used-cn-3,10.0.201.255
...

Add all the reserved IP-addresses to this file, formatted as <Common-Name>,<IP-address>. For the value in field <Common-Name> choose something that will never by used in any client certificate.

This is not guaranteed to work always, as stated in the OpenVPN manpage:

Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, use --ifconfig-push

DHCP-proxy mode

Since you are using a TAP setup, this might be the best solution. It allows to use a fully featured DHCP server on the server side subnet or on the server itself, depending on the configuration. To configure ethernet bridging, you must first use your OS's bridging capability to bridge the TAP interface with another interface.

OpenVPN server config:

server-bridge

This directive expands as follows:

mode server
tls-server
push "route-gateway dhcp"

DHCPD server config:

subnet 10.0.100.1 netmask 255.255.0.0 
 range 10.0.200.1 10.0.200.254;
 range 10.0.201.1 10.0.201.254;
 range 10.0.202.1 10.0.202.254;
 range 10.0.203.1 10.0.203.254;
 ...

Multiple instances

An alternative would be to create a separate openvpn instance for each /24 subnet, using multiple configuration files. But this requires using a different port for each instance.

Instance 1 config file:

port 11941
server-bridge 10.0.100.1 255.255.0.0 10.0.200.1 10.0.200.254

Instance 2 config file:

port 11942
server-bridge 10.0.100.1 255.255.0.0 10.0.201.1 10.0.201.254

...

This would require:

• either IP-range specific client configurations with the respective port numbers,


• or e.g. to use iptables load balancing on incoming connections on port 1194 and distribute them evenly across the instances

This solution could have performance benefits, as explained here.