This series of posts explores useful OpenVPN server configuration options, including secure cryptographic algorithms, client-to-client communication, private network access, and VPN subnet management.

Important: Ensure that all required options are added to and saved in your OpenVPN server configuration file, typically /etc/openvpn/server.conf. Configuration paths may vary depending on your installation.

1. Define the VPN Client Subnet

When configuring an OpenVPN server, you need to define the virtual network used to assign IP addresses to connecting VPN clients.

The server directive creates a routed VPN configuration, establishes the VPN subnet, and manages client IP address allocation.

For example, to configure a VPN subnet using 10.8.0.0/24, add the following directive to your server configuration:

# Define the VPN client subnet
server 10.8.0.0 255.255.255.0

This configuration establishes a virtual IPv4 network for the VPN clients.

Understanding the Configuration

server

The server directive configures OpenVPN to operate in routed server mode. It establishes the VPN network, configures the necessary routing parameters, and manages IP address allocation for connecting clients.

10.8.0.0

This is the network address identifying the VPN subnet. It represents the network as a whole rather than an individual client address.

In this example, the VPN subnet is 10.8.0.0/24.

255.255.255.0

This is the subnet mask, equivalent to a /24 prefix. It defines the size of the IPv4 network.

A /24 subnet contains 256 total IPv4 addresses, including the network and broadcast addresses. In a conventional subnet, that leaves 254 usable host addresses.

However, this does not mean OpenVPN can necessarily support 254 simultaneous clients. OpenVPN's address-allocation behavior, server configuration, and reserved addresses affect the number of clients that can be accommodated.

2. How Does the VPN Subnet Work?

When a client connects to the OpenVPN server, the server assigns it an IP address from the configured VPN address pool.

For example, a VPN using 10.8.0.0/24 might have the following layout:

VPN Subnet: 10.8.0.0/24

OpenVPN Server
      |
      | 10.8.0.1
      |
      +----------------------+
      |                      |
      v                      v
   Client A               Client B
   10.8.0.2               10.8.0.3

These addresses are illustrative; actual assignments depend on the OpenVPN configuration.

The VPN subnet provides an addressing scheme that allows the server and connected clients to communicate through the virtual network.

Depending on your routing configuration, clients may also be able to access private network resources or communicate with one another.

Important: Defining the VPN subnet does not automatically grant access to every internal network. Additional routing, forwarding, and firewall configuration may be required.

3. Choose the Appropriate VPN Subnet

You can change the VPN subnet and subnet mask to suit your network requirements.

For example:

# Example: VPN subnet using 10.9.0.0/24
server 10.9.0.0 255.255.255.0

Or:

# Example: VPN subnet using 10.20.0.0/24
server 10.20.0.0 255.255.255.0

Before selecting a subnet, consider the following:

• Avoid overlapping networks: The VPN subnet should not conflict with the server's LAN, remote client networks, or other networks clients need to access.
• Plan for client capacity: Choose a subnet that provides sufficient address space for your expected number of simultaneous connections.
• Consider future expansion: Allow room for additional clients if your VPN deployment is expected to grow.
• Review routing requirements: Ensure that your VPN subnet works with your existing routing tables, firewall rules, and internal network architecture.

For example, if both a remote client's local network and your VPN use 10.8.0.0/24, the overlapping address ranges can create routing conflicts.

Selecting a non-overlapping subnet helps avoid these problems.

4. Apply and Verify the Configuration

After adding the directive, save the configuration file and restart the OpenVPN service.

For installations using the openvpn@server systemd unit:

$ sudo systemctl restart openvpn@server.service

Check the service status:

$ sudo systemctl status openvpn@server.service

If the service fails to start, inspect the logs:

$ sudo journalctl -u openvpn@server.service -n 50 --no-pager

Reconnect your VPN clients to ensure they receive their configuration.

On a Linux client, inspect the assigned addresses:

$ ip addr

Look for the VPN interface, often named tun0, and verify that it has an address from the expected VPN subnet.

You can also inspect the client's routing table:

$ ip route

The exact interface name, assigned addresses, and routes depend on your OpenVPN configuration.

Note: The appropriate systemd service name and configuration path vary between OpenVPN installations.

The OpenVPN server directive provides a straightforward way to define the virtual IPv4 subnet used by connecting VPN clients.

For example:

server 10.8.0.0 255.255.255.0

This establishes a routed VPN subnet using 10.8.0.0/24 and enables OpenVPN to manage client address allocation.

Choosing an appropriate subnet is an important part of VPN network design. By avoiding address conflicts and planning for sufficient capacity, you can build a more reliable and scalable VPN deployment.

We hope this guide proves useful in configuring and securing your OpenVPN server.