OpenVPN - Static IP vs Dynamic Pool

[Kevin K]

I need to assign one user a static IP address; I need to be sure no other users will get that address. I'm doing this because I'm using iptables to grant only this one user access to the LAN. All other users get outbound access to the WAN only.

If I do this the 'standard' way, I need to use ifconfig-pool to limit the dynamic addresses so they won't conflict with my static address. This is a pain because it means I have to use a postconf script to remove the 'server' option because 'server' and 'ifconfig-pool' are incompatible and Merlin uses 'server'.

I'd like to be creatively lazy.

If I set "max-clients 20" and I put my VPN on 10.1.0.0, it seems to me like the dynamically assigned addresses would never exceed 10.1.0.20, and I could safely assign my static user (or users) beginning at 10.1.0.100 without fear of conflict.

Can I get away with this? Am I missing a risk?

 

[CaptainSTX]

I need to assign one user a static IP address; I need to be sure no other users will get that address. I'm doing this because I'm using iptables to grant only this one user access to the LAN. All other users get outbound access to the WAN only.

If I do this the 'standard' way, I need to use ifconfig-pool to limit the dynamic addresses so they won't conflict with my static address. This is a pain because it means I have to use a postconf script to remove the 'server' option because 'server' and 'ifconfig-pool' are incompatible and Merlin uses 'server'.

I'd like to be creatively lazy.

If I set "max-clients 20" and I put my VPN on 10.1.0.0, it seems to me like the dynamically assigned addresses would never exceed 10.1.0.20, and I could safely assign my static user (or users) beginning at 10.1.0.100 without fear of conflict.

Can I get away with this? Am I missing a risk?

If you mean "security risk" to your network then depending how the static IP is assigned AND if it is not associated with a specific MAC address then a malicious user could using various utilities assign their device the specific IP that you have designated to access the VPN tunnel. If you use the router to assign the static IPs this risk is minimized since the router will based on MAC of the device connecting assign it a designated static IP however a user could by using a utility spoof/clone the MAC address of a device you have designated and then the router will give it the IP for that MAC in its list of static IPs.

 

[Kevin K]

Just to be sure I'm clear...
I understand how users can ignore DHCP-assigned addresses on a non-VPN LAN. (e.g. You just configure the interface for a static IP.) If I code "ifconfig-push 10.1.0.123 255.255.255.0" at the server, are you saying that the OpenVPN client can override that server-assigned IP?

 

[Martineau]

If I code "ifconfig-push 10.1.0.123 255.255.255.0" at the server, are you saying that the OpenVPN client can override that server-assigned IP?

In theory I think they could by using the 'pull-filter' directive etc.

pull-filter ignore ifconfig
ifconfig xxx.xxx.xxx.253 xxx.xxx.xxx.254

but I don't think they would be able to access anything with their sneaky config?