{"id":20393,"date":"2020-06-09T13:32:28","date_gmt":"2020-06-09T13:32:28","guid":{"rendered":"http:\/\/www.firewallhardware.it\/pfsense-e-openvpn-come-assegnare-un-ip-fisso-su-client-remoto\/"},"modified":"2022-03-28T10:34:21","modified_gmt":"2022-03-28T10:34:21","slug":"pfsense-and-openvpn-how-to-assign-a-fixed-ip-on-remote-client","status":"publish","type":"post","link":"https:\/\/blog.miniserver.it\/en\/pfsense\/pfsense-and-openvpn-how-to-assign-a-fixed-ip-on-remote-client\/","title":{"rendered":"pfSense and OpenVPN: how to assign a fixed IP on remote client."},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">What we will see in this guide:<\/h3>\n\n\n\n<p>This guide illustrates how <strong>to assign a fixed IP<\/strong> (which can then be used in firewall rules) to a client that connects to a VPN, in particular <strong>OpenVPN<\/strong>, with a specific user.<\/p>\n\n\n\n<p>This will allow me to create access rules for a user who logs into the VPN on the firewall.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Hardware and software environment<\/h3>\n\n\n\n<p>We carried out the tests in the laboratory with the <strong>pfSense system.<\/strong><br>The hardware selected for the tests are:<\/p>\n\n\n\n<p><strong>Tested Firewall Datacenter:<\/strong><br>For the <strong>VPN Firewall<\/strong> we chose this device: <a title=\"A1 Server\" href=\"https:\/\/www.miniserver.it\/firewall\/appliance-a1-server-aluminum\" target=\"_blank\" rel=\"noopener noreferrer\">A1 Server<\/a><\/p>\n\n\n\n<p>The <strong>software used<\/strong> on the appliance is <strong>pfSense\u00ae version 2.4.X<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Introduction:<\/h3>\n\n\n\n<p>It is assumed that an OpenVPN server has already been created and one or more correctly configured users exist.<br>For a guide on how to create a VPN (OpenVPN) on pfSense follow the following guide: <a href=\"https:\/\/blog.miniserver.it\/en\/pfsense-and-openvpn-guide-to-creating-and-configuring-a-road-warrior-vpn-server\/\">https:\/\/blog.miniserver.it\/en\/pfsense-and-openvpn-guide-to-creating-and-configuring-a-road-warrior-vpn-server\/<\/a><\/p>\n\n\n\n<p>For those who wish, we have also published a video that illustrates the steps we have performed below.  <\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"video-shortcode\"><iframe title=\"IP Statico: 3 Passi per Assegnarlo (OpenVPN su pfSense)\" width=\"1080\" height=\"608\" src=\"https:\/\/www.youtube.com\/embed\/zZPUytpWVJY?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe><\/div>\n<\/div><\/figure>\n\n\n\n<p>Let&#8217;s configure the Client Specific Overrides in OpenVPN:<\/p>\n\n\n\n<p>First we identify an IP address that must belong to the VPN network that cannot be assigned to other users. In our example we know that a maximum of 10 users can connect; the assigned network is 10.10.94.0\/24 and therefore we have chosen the IP 10.10.94.30<\/p>\n\n\n\n<p>Subsequently, we precisely identify the user to whom we want to assign the IP just chosen, checking from <strong>System<\/strong>\u2192<strong>User Manager<\/strong>\u2192<strong>Users<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1000\" height=\"487\" src=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso1.jpg\" alt=\"OpenVPN ip fisso\" class=\"wp-image-20379\" srcset=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso1-300x146.jpg 300w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso1-768x374.jpg 768w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso1.jpg 1000w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p> In our example: user1<\/p>\n\n\n\n<p>At this point we position ourselves below<br><strong>VPN<\/strong>\u2192<strong>OPENVPN<\/strong>\u2192<strong>Client Specific Overrides<\/strong><br>And we add a voice.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1000\" height=\"525\" src=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso2.jpg\" alt=\"OpenVPN ip fisso\" class=\"wp-image-20381\" srcset=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso2-300x158.jpg 300w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso2-768x403.jpg 768w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso2.jpg 1000w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p>We select the desired openvpn server; in our case we only have one.<br>Then we write the exact name of the user in the &#8220;<strong>Common Name<\/strong>&#8221; field; in our example: user1<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1000\" height=\"822\" src=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso3.jpg\" alt=\"OpenVPN ip fisso\" class=\"wp-image-20383\" srcset=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso3-300x247.jpg 300w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso3-768x631.jpg 768w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso3.jpg 1000w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p>So let&#8217;s go to the bottom of the page and enter in advanced settings: ifconfig-push 10.10.94.30 255.255.255.0<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1000\" height=\"784\" src=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso4.jpg\" alt=\"OpenVPN ip fisso\" class=\"wp-image-20385\" srcset=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso4-300x235.jpg 300w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso4-768x602.jpg 768w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso4.jpg 1000w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p>Even if we do not describe it here, if we want we can assign the ip DI to a completely different network, operating in the Tunnel settings section.<br>At this point we save. From now on when the user: user1 will connect to the <strong>OPENVPN VPN<\/strong>, he will always be assigned the IP 10.10.94.30<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How we use this configuration in the rules<\/h3>\n\n\n\n<p>Once we know that user user1 will connect with IP 10.10.94.30, we can use this information to create our rules.<\/p>\n\n\n\n<p>Let&#8217;s go under <strong>Firewall<\/strong>\u2192<strong>Rules<\/strong>\u2192<strong>OpenVPN<\/strong><\/p>\n\n\n\n<p>By placing the IP 10.10.94.30 in the Source field, we can decide which IP our <strong>VPN<\/strong> user can access and which ports\/services.<br>In fact, they are exactly rules as if the <strong>OpenVPN<\/strong> interface were a physical interface and the user user1 was using a PC with a fixed IP.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1000\" height=\"602\" src=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso5.jpg\" alt=\"OpenVPN ip fisso\" class=\"wp-image-20387\" srcset=\"https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso5-300x181.jpg 300w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso5-768x462.jpg 768w, https:\/\/blog.miniserver.it\/wp-content\/uploads\/firewallhardwareOpenVPNipFisso5.jpg 1000w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p>The rules above allow only the address 10.10.94.10, to access the IP 192.168.201.10 (in this example an IP of the LAN) on any port.<\/p>\n\n\n\n<p>The remaining traffic will be blocked!<\/p>\n\n\n\n<p>In our example, the last deny rule is actually not needed, we only put it to make explicit the deny which in fact is how the firewall behaves if no rule is applied.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This guide illustrates how to assign a fixed IP (which can then be used in firewall rules) to a client that connects to a VPN<\/p>\n","protected":false},"author":11,"featured_media":21389,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[124],"tags":[270,138],"class_list":["post-20393","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-pfsense","tag-openvpn-e-pfsense-en","tag-pfsense-en"],"_links":{"self":[{"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/posts\/20393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/comments?post=20393"}],"version-history":[{"count":4,"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/posts\/20393\/revisions"}],"predecessor-version":[{"id":24526,"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/posts\/20393\/revisions\/24526"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/media\/21389"}],"wp:attachment":[{"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/media?parent=20393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/categories?post=20393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.miniserver.it\/en\/wp-json\/wp\/v2\/tags?post=20393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}