我已经设置了一个可正常运行的 OpenVPN 网络（带路由）……除了 IP 预留之外，其他一切都正常。我有一个与服务器上的 IP 预留相关联的“特殊”客户端证书。我完成了所有配置：创建了 ccd 文件夹，其中包含客户端文件的 CN，并编辑了 ipp 文件。但是，当我尝试连接到我的 VPN 时，我的服务器总是向我的客户端提供不同的 IP。这怎么可能呢？非常感谢！
服务器配置：
# Which local IP address should OpenVPN
# listen on? (optional)
local 192.168.1.2
# Port listening on:
port 1194
# TCP or UDP server?
proto udp
dev tun
# Certs:
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
# Diffie hellman parameters.
dh /etc/openvpn/dh2048.pem
# VPN Subnet:
server 10.2.1.0 255.255.255.0
# Static IPs:
ifconfig-pool-persist ipp.txt
# Client Custom Config Dir:
client-config-dir /etc/openvpn/ccd
# Tunneling traffic through VPN:
push "redirect-gateway"
# Push (Windows-Specific) DNS:
push "dhcp-option DNS 8.8.8.8"
# Clients will be able to contact each other:
client-to-client
# The Server will accept clients with the same certificate:
duplicate-cn
# Pings every 300 seconds and wait 900 seconds for a response (to keep alive the connection):
keepalive 300 900
# Compression:
comp-lzo
# Privilege downgrade: (Linux Specific)
user nobody
group nobody
persist-key
persist-tun
# Quick Log:
status openvpn-status.log
# Logs:
log openvpn.log
log-append openvpn.log
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3
# Pushing Routes:
route 10.2.1.0 255.255.255.0
push "route 10.2.2.0 255.255.255.0"
客户端配置：
# Configuration Type:
client
# Device Type:
dev tun
# Protocol:
proto udp
# VPN Server IP:
remote X 1194
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
user nobody
group nobody
# Try to preserve some state across restarts.
persist-key
persist-tun
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
mute-replay-warnings
# Certs:
ca ca.crt
cert crt.crt
key key.key
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".
ns-cert-type server
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
答案1
编辑指定的文件ifconfig-pool-persist不是为主机设置永久静态地址的正确方法。
如果您想永久地发出一个地址，更好的解决方案是使用ifconfig-push local remote该主机的客户端配置文件中的指令。