OpenVPN Client-specific routing when using username/password authentication

configurationopenvpnroutingvpn

So I have an openvpn running on a debian machine and I have set it up to work with PAM authentication via the pam module AND NOT the provided example script. However, requirements changed and now I need to start pushing specific client configuration to my users. After digging up a bit I used the client-config-dir directive and username-as-common-name but unfortunately my client specific settings aren't pushed. I suspect it is due to the fact that username-as-common-name might only be working if used with auth-user-pass-verify auht-pam.pl via-file setting. I'm pasting my configuration file here: 

port 1194
proto udp
daemon
dev tun
keepalive 5 15
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.10.11.0 255.255.255.0
;push "redirect-gateway def1"
push "route 87.121.59.0 255.255.255.0"
push "route 77.95.0.0 255.255.0.0"
push "route 72.233.0.0 255.255.0.0"
push "route 193.47.74.0 255.255.255.0"
push "route 72.233.107.0 255.255.255.0"
push "route 184.107.160.211 255.255.255.255"
push "route 85.17.103.0 255.255.255.0"
push "route 173.201.97.0 255.255.255.0"
push "route 95.211.34.0 255.255.255.0"
push "route 80.72.68.217 255.255.255.255"
push "route 87.121.59.0 255.255.255.0"
push "route 85.14.44.0 255.255.255.0"
;route-gateway 10.10.11.5
verb 5
log /var/www/random_log
;client-to-client
status openvpn-status.log 7200
plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth
client-cert-not-required
;auth-user-pass-verify auth-pam.pl via-file
username-as-common-name
client-config-dir ccd
#comp-lzo

In essence I want client-specific settings to work AND to retain logging using the PAM module and not the provided script.

Best Answer

same for me i used your post to find put how to do it without cert in a server-client scenario

just placed in openvpn config file:

  • route for vpnserver to manage the route (not push because i'm not pushing routes to clients yet)

  • plus these two lines

username-as-common-name

client-config-dir /etc/openvpn/ccd

and a similar iroute command in ccd directory in a file called as the username.

Related Topic