-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Patrick Holthaus wrote:
> Now my questions are:
> Do I need bridging for making the DHCP server work in the VPN?
> How should the configuration files look like?
I don't think you can do it, because the openvpn client needs an IP provided by
the OpenVPN server
software to obtain the tunnel. If you want OpenVPN to provide a certain subnet
range for your
openvpn clients, then check out:
- --server network netmask
A helper directive designed to simplify the configuration of OpenVPN's
server mode. This
directive will set up an OpenVPN server which will allocate addresses to
clients out of the given
network/netmask. The server itself will take the ".1" address of the given
network for use as the
server-side endpoint of the local TUN/TAP interface.
For example, --server 10.8.0.0 255.255.255.0 expands as follows:
mode server
tls-server
push "topology [topology]"
if dev tun AND (topology == net30 OR topology == p2p):
ifconfig 10.8.0.1 10.8.0.2
ifconfig-pool 10.8.0.4 10.8.0.251
route 10.8.0.0 255.255.255.0
if client-to-client:
push "route 10.8.0.0 255.255.255.0"
else if topology == net30:
push "route 10.8.0.1"
if dev tap OR (dev tun AND topology == subnet):
ifconfig 10.8.0.1 255.255.255.0
ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
push "route-gateway 10.8.0.1"
Don't use --server if you are ethernet bridging. Use --server-bridge
instead.
- --server-bridge gateway netmask pool-start-IP pool-end-IP
A helper directive similar to --server which is designed to simplify the
configuration of
OpenVPN's server mode in ethernet bridging configurations.
To configure ethernet bridging, you must first use your OS's bridging
capability to bridge the
TAP interface with the ethernet NIC interface. For example, on Linux this is
done with the brctl
tool, and with Windows XP it is done in the Network Connections Panel by
selecting the ethernet and
TAP adapters and right-clicking on "Bridge Connections".
Next you you must manually set the IP/netmask on the bridge interface. The
gateway and netmask
parameters to --server-bridge can be set to either the IP/netmask of the bridge
interface, or the
IP/netmask of the default gateway/router on the bridged subnet.
Finally, set aside a IP range in the bridged subnet, denoted by
pool-start-IP and pool-end-IP,
for OpenVPN to allocate to connecting clients.
For example, server-bridge 10.8.0.4 255.255.255.0 10.8.0.128 10.8.0.254
expands as follows:
mode server
tls-server
ifconfig-pool 10.8.0.128 10.8.0.254 255.255.255.0
push "route-gateway 10.8.0.4"
[taken from: http://openvpn.net/man.html no Named Anchors there...]
- --
Arturo "Buanzo" Busleiman - Consultor Independiente en Seguridad Informatica
Enigform for Firefox: A secure browsing experience: http://enigform.mozdev.org
Mail Hosting Seguro y Consultoria - http://www.buanzo.com.ar/pro/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFF+9NiAlpOsGhXcE0RCrNbAJ924t72yJMexav/3YESNXHziZm4OACeJy6s
tLlNylW4KHjPt4ngjest/jE=
=gIhv
-----END PGP SIGNATURE-----
--
[email protected] mailing list
