Hi Folks,

Just about to set up an openvpn system for member of the public. I'm using a routed (dev tun) openvpn system.

Now my questions is:

I know that I can push certain IP's to clients. Now, on a normal LAN, clients are free to change their IP address manually (Just by going into network settings). Can this be done in Openvpn? Hopefully not

I tried this on a test bed and it didn't work (which is great!) - the server just kept saying "bad source address" or something like that.

So does openvpn really prevent IP spoofing? Or was I not doing something to make my spoof attack work?

Cheers

P.S. The reason why IP is so important is that my squid logging system is based on client IP connections

hi,

nice idea,
never tried that - but, i'm wondering which IP/subnet did you push to the VPN client?
was it something like /32, or /30 as p2p links or a standard subnet like /24 etc?

my catch is that you can not change an IP being used in an established VPN session just like that - unlike on basic ethernet network.

just a thought.

anyway, i see that you need a squid mechanism to disconnect an overlimit session in your tunnel server? on the other post.

yes, you can do that - try to search around squid delay pool.
i've seen my friends doing that to limit and even to drop downloads if it has reaching the limit (aside from using ACLs).
yes, the basic squid delay pool purpose was only to limit/shaping the link - but, with a little hack - it can drop the connection too.

HTH.

If you use tun mode IP spoofing is prevented, in tap mode it behaves like Ethernet.

That's great about openvpn ip spoofing! One stept closer to my needs!

You were mentioning Squid delay pools - is there any way to log the amount used though and somehow dynamically change them if e.g. the client were to "top his account up"?

hi,

you mean squid logging? or perhaps any other logging?
squid logging basically can be done using squid analyzer via webmin module.

http://freshmeat.net/projects/squidanalyzer/

but the drop if over limit mechanism should be done via delay pool. if you can write some script - i think you can combine them both.

and you can also put an openldap-based browser authentication - so that you dont have to open the whole VPN port - just what your users need to have like 80, 443, 53 etc.

HTH.

Hi rossonieri,

Where did you find a plugin for Sqyiud Analyzer? It sounds pretty good from that link you gave me

Cheers

hi jonny,

you may also check SARG - Squid Analyzer and Report Generator :
http://sarg.sourceforge.net/

or as a webmin module :
http://www.webmin.com/cgi-bin/search....cgi?modules=1

(just Ctrl+F and type "squid")

HTH.