search

kylemanna / docker-openvpn

🔒 OpenVPN server in a Docker container complete with an EasyRSA PKI CA
https://hub.docker.com/r/kylemanna/openvpn/
MIT License
8.62k stars 2.37k forks source link

Change Topology to subnet instead of net30 to utilise addresses more efficiently #683

Open raj-saxena opened 2 years ago

raj-saxena commented 2 years ago

First, thanks for the great work!

We actively use OpenVPN and have the server configured with the -s 192.168.0.0/24 option. We were assuming that this would support ~256 connected users but have recently started seeing errors - no free --ifconfig-pool addresses are available. I saw a related discussion here https://github.com/kylemanna/docker-openvpn/issues/444 & have updated our server mask for more IPs.

However, as part of investigation, I came across the following page that says modern OpenVPN should be running in subnet mode instead of net30. https://docs.netgate.com/pfsense/en/latest/vpn/performance.html#topology

When I checked our server logs, I saw a bunch of logs containing topology net30:

... route 192.168.255.1,topology net30,ping 10,ping-restart 60,peer-id 43,...

The OpenVPN configuration docs recommends using topology subnet as well.

I have regenerated config for my server with -e "topology subnet" & verified that the config pool log shows increased size.

Thu Nov 25 10:34:50 2021 IFCONFIG POOL: base=192.168.8.2 size=1020, ipv6=0

It would be nice to have this option by default.