nopool option OpenVPN Server

[Kevin K]

In a 2008 change log, I see

Now, for example, we can configure thusly:

server 10.8.0.0 255.255.255.0 nopool
ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0​

Is there a way to get "nopool" added to the server directive via the GUI, or do I have to stop using the GUI to go here?

I need to reduce the address pool handed out by OpenVPN, so that I can use a few for static-ip users on the VPN.

 

[Martineau]

server 10.8.0.0 255.255.255.0 nopool
ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0

Is there a way to get "nopool" added to the server directive via the GUI, or do I have to stop using the GUI to go here?

Did you not see this on the VPN Server configuration GUI?

 

[Kevin K]

@Martineau - Thank you for your reply. I can't tell whether you are calling my attention to the "Manage Client Specific Options" or to the "Custom Configuration" field, or both -- I'll assume both.

Whether I set "Manage Client-Specific Options" to Yes or No, config.ovpn contains "server 10.8.0.0 255.255.255.0". If I later add my own "server 10.8.0.0 255.255.255.0 nopool", which one wins?

 

[Martineau]

@Martineau Whether I set "Manage Client-Specific Options" to Yes or No, config.ovpn contains "server 10.8.0.0 255.255.255.0". If I later add my own "server 10.8.0.0 255.255.255.0 nopool", which one wins?

Hmm.....<sigh> perhaps examining the appropriate resulting generated config?

e.g. for Server 1

/etc/openvpn/server1/config.ovpn

 

[Kevin K]

Hmm.....<sigh> perhaps examining the appropriate resulting generated config?

e.g. for Server 1

/etc/openvpn/server1/config.ovpn

Of course. That's how I knew it had both
"server 10.8.0.0 255.255.255.0" and "server 10.8.0.0 255.255.255.0 nopool".

What config.ovpn doesn't clarify is which one is defined to "win" when OpenVPN loads them. Empirically, today, with the version included with Merlin 308.65_2, it appears to choose the latter and not the former. Without a clear definition as to which one wins when there are conflicting directives, behavior could change with a later release (or even be affected when I change some other option).

Of course, if I were in an enterprise environment, I would thoroughly QA each release in a lab before migrating to it. OTOH, if I were in an enterprise environment, I'd hardly be running with a consume-grade router. ;-)

 

[Martineau]

Without a clear definition as to which one wins when there are conflicting directives, behavior could change with a later release (or even be affected when I change some other option).;-)

Well clearly that is something you should take up with the OpenVPN developers - this is a router firmware support forum, not an OpenVPN support forum!

OTOH, if I were in an enterprise environment, I'd hardly be running with a consume-grade router. ;-)

Actually, working for the world's 2nd largest IT company, you'd be surprised what the bean-counters force us to use internally

Anyway, to ensure there is no ambiguity in the processing of the VPN config directives...

RTFM!

https://github.com/RMerl/asuswrt-merlin/wiki/Custom-config-files

Hint: You will need to create the script /jffs/scripts/openvpnserver1.postconf.

 

[john9527]

Hint: You will need to create the script /jffs/scripts/openserver1.postconf.

Second hint: There is now also a pc_delete directive that hadn't been documented yet in the wiki. (I just added it )

 

[Martineau]

Second hint: There is now also a pc_delete directive that hadn't been documented yet in the wiki. (I just added it )

OK thanks...although I personally choose to hand-craft the 'sed' statements rather than use the 'helper' functions.
Can't remember why? - vaguely recall I was trying to use 'regexp' such as '^start of line.*$' to get rid of a particular line and it failed to work.

P.S. Fixed my typo '/jffs/scripts/openserver1.postconf' should read '/jffs/scripts/openvpnserver1.postconf'

P.P.S. Perhaps the wiki should be updated now while it's on your mind!?

 

[john9527]

P.P.S. Perhaps the wiki should be updated now while it's on your mind!?

That's what I meant....wiki has been updated.....the pc_delete function had been added a while ago