Docker-openvpn: How to allow more than 254 clients?

[Leen15]

Hi,
I'm using this docker image with default configuration and I've about 20 clients connected.
I see that for default conf, the subnet configured is 192.168.255.0/24.
This allows to connect only 254 clients.
How could I move to a different conf that allow to connect more clients? (like 5000+).
I would like to do this without touch the configuration on current clients if it's possible.

Thanks!

[Leen15]

@kylemanna ?

[mathieu-aubin]

wouldnt changing the network prefix do the job? have you tried?

[Leen15]

@mathieu-aubin how can I do it? Is there a wiki for it?
If I change it, my clients will reconnect correctly?

[mathieu-aubin]

check this asciicast in order to get what i am trying to say

This table shows the different subnet prefix lengths
https://www.cisco.com/c/dam/en_us/about/ac123/ac147/images/ipj/ipj_9-1/91_ip_fig_03_sm.jpg

prefix lengths and subnets is complicated but i would hope that simply changing the subnet from 24 to 20 (close enough to 5000) will help you in achieving the desired outcome

[Leen15]

Thanks @mathieu-aubin for the explanation.
How can I set this network configuration in this openvpn image?

[mathieu-aubin]

I will see about building the image and getting you some sort of answer.
in the meantime, you could try changing the initial "192.168.255.0/24" in the config to something more suitable and see.

Do you have means of testing this at all?

[Leen15]

I just found this:
https://github.com/kylemanna/docker-openvpn/issues/394

Where there should be a parameter to pass to the genconfig for force a different network.
I'll try!

[mathieu-aubin]

This has nothing to do with the docker image but is actually the config options of openvpn 2.4x
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

If you check it closely, you will see that there is an option you can pass wich is handily called

--max-clients n : Allow a maximum of n simultaneously connected clients.

after thinking about it, i believe the network setting you are trying to change will have no effect on the max number of clients as this is routing informations only. If your instance works as it is, leave that.

Try instead adding the switch --max-clients to the startup/init file

[Amaelh]

Well OpenVPN still needs to allocate an IP adress to each client, so the subnet 192.168.255.0 is indeed limited to 254. We should be able to allow more clients by using a broader subnet inside the 192.168.0.0/16 prefix. This whole prefix allows for 2^(32-16) = 65 536 adresses so you can just use it as it.

Theoretically you should be able to do this on server side without impacting the current clients, they will just not see any new client having an IP adress allocated outside 192.168.255.*.

[mathieu-aubin]

This has nothing to do with the docker image but is actually the config options of openvpn 2.4x
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

If you check it closely, you will see that there is an option you can pass wich is handily called

--max-clients n : Allow a maximum of n simultaneously connected clients.

after thinking about it, i believe the network setting you are trying to change will have no effect on the max number of clients as this is routing informations only. If your instance works as it is, leave that.

Try instead adding the switch --max-clients to the startup/init file

well, after reading, it could after all be something of interrest.

If you wanted to edit the openvpn config file inside the container, try checking for the volume in

/var/lib/docker/volumes/

or even, run a find command

find /var/lib/docker/volumes -type f -name openvpn.conf

or to get the exact location of the volume...

docker volume inspect NAME_OF_VOLUME

[Leen15]

Sorry guys I don't understand how to proceed :(
I can edit the file openvpn.conf inside the openvpn container and reload the service?
Should I edit only the network to 192.168.0.0/16 ?
Does the server change its own ip? (now it is 192.168.255.1)

[Leen15]

My current configuration of /etc/openvpn/openvpn.conf is this:

server 192.168.255.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/***.***.***.***.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/***.***.***.***.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun
client-to-client

proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log

user nobody
group nogroup
comp-lzo no

### Route Configurations Below
route 192.168.254.0 255.255.255.0

### Push Configurations Below
push "block-outside-dns"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "comp-lzo no"

Can you tell me what should I change?

[Amaelh]

Sorry, I just tested changing server and route configurations but I can't make it work in my current network configuration. I'm messing up the route to my local DNS server (192.168.0.x)...

But it might work on your side as you use public DNS servers so you could give it a try. My guess was to change these lines :

server 192.168.0.0 255.255.0.0
route 192.168.0.0 255.255.0.0

And yes editing the file + restarting the container is enough for the parameters to be taken in account.

[Leen15]

@Amaelh I tried with your configuration and it works!
The only issue is that the server ip changes from 192.168.255.1 to 192.168.0.1 and I should avoid this.
Is there a way to keep the same ip?
I already tried to set:
server 192.168.255.0 255.255.0.0
but of course I receive an error:
Options error: --server directive network/netmask combination is invalid

[Amaelh]

Nice ! OpenVPN seems to support this by manually editing this file (e.g. : https://serverfault.com/a/813986), but I don't master the "route" directive sufficiently to give you a working example for your case.

You might get more support on their website as this github is merely focused on encapsulating their product inside a docker image.

[Leen15]

Yes that link is exactly what I just found. I'll try with that way.
Thanks for your support guys, we can close this.

[mathieu-aubin]

according to what i could understand from what you guys found out, the following should keep the server ip to the desired one while also setting a netmask of /18 (which translates into 255.255.192.0)

server 192.168.255.0 255.255.192.0

sipcalc returns the following infos when using

sipcalc 192.168.255.0/18


Address       = 192.168.255.0
                   11000000 . 10101000 . 11111111 . 00000000
Network       = 192.168.192.0 / 18
Netmask       = 255.255.192.0
Broadcast     = 192.168.255.255
Wildcard Mask = 0.0.63.255
Hosts Bits    = 14
Max. Hosts    = 16382   (2^14 - 2)
Host Range    = { 192.168.192.1 - 192.168.255.254 }
Properties    =
   - 192.168.255.0 is a HOST address in 192.168.192.0/18
   - Class C
   - Private
GeoIP AS Info = Unknown
GeoIP Country = Unknown (??)
Performing reverse DNS lookup ...DNS Hostname  = (Name or service not known)

[oldthreefeng]

according to what i could understand from what you guys found out, the following should keep the server ip to the desired one while also setting a netmask of /18 (which translates into 255.255.192.0)

server 192.168.255.0 255.255.192.0

sipcalc returns the following infos when using

sipcalc 192.168.255.0/18


Address       = 192.168.255.0
                   11000000 . 10101000 . 11111111 . 00000000
Network       = 192.168.192.0 / 18
Netmask       = 255.255.192.0
Broadcast     = 192.168.255.255
Wildcard Mask = 0.0.63.255
Hosts Bits    = 14
Max. Hosts    = 16382   (2^14 - 2)
Host Range    = { 192.168.192.1 - 192.168.255.254 }
Properties    =
   - 192.168.255.0 is a HOST address in 192.168.192.0/18
   - Class C
   - Private
GeoIP AS Info = Unknown
GeoIP Country = Unknown (??)
Performing reverse DNS lookup ...DNS Hostname  = (Name or service not known)

this helps me a lot