This is an old revision of the document!
Table of Contents
PFSense - VPN - OpenVPN - Assign a fixed IP to a remote client
Assigning a fixed IP to a client that connects to a VPN, in particular OpenVPN, with a specific user, can then be used in firewall rules.
It is assumed that an OpenVPN server has already been created and one or more correctly configured users exist.
Identify a fixed IP address for the Client to use
Navigate to VPN → OpenVPN.
In Servers, check the network used by the specific VPN Server.
In this case it is 10.20.30.0/24.
The fixed IP address for the client must be a unique IP within this subnet, lets say for example 10.20.30.69.
Identify the user to whom we want to assign the IP just chosen
Navigate to System → User Manager → Users.
Select the specific user to assign the fixed IP address to.
- Make a note of the actual username. Lets assume this is peter.
Allocate the fixed IP to the User
Navigate to VPN → OpenVPN → Client Specific Overrides.
Click Add.
In General Information:
- Server List: Select the desired OpenVPN server.
- Common Name: peter. This needs to be the exact name of the user.
- This should be exactly the same as identified in the earlier step Identify the user to whom we want to assign the IP just chosen.
In Client Settings:
- Advanced Settings: ifconfig-push 10.20.30.69 255.255.255.0.
- Click Save.
NOTE: From now on when peter connects to the OpenVPN Server, he will always be assigned the IP 10.20.30.69,
Test
Connect to the VPN Server from the Client.
Check the IP Address of the Connected Client.
Navigate to Status → OpenVPN.
- Check the Virtual Address.
Configure Firewall Rules for this User
We know that the user, peter, will connect with IP 10.20.30.69.
Firewall rules can therefore be configured using this IP.
By placing the IP 10.20.30.69 in the Source field, we can decide which IP our VPN user can access and which ports/services.
In fact, they are exactly rules as if the OpenVPN interface were a physical interface and User1 was using a PC with a fixed IP.
NOTE: The rules above allow only the address 10.20.30.69, to access the IP 192.168.1.x on any port.
The remaining traffic will be blocked!
The last deny rule is actually not needed. It is only put in to to make explicit the deny which in fact is how the firewall behaves if no rule is applied.