working ig

openvpn/server.conf

@@ -10,21 +10,28 @@ dev tun0
 topology subnet
 
 server 172.31.8.0 255.255.255.0
-ifconfig-pool-persist /var/lib/openvpn/ipp.txt
+
+# Identity = AD username (username-as-common-name), and one user WILL
+# connect from several devices (laptop + phone). duplicate-cn allows the
+# concurrent sessions and gives each its own pool IP. Sticky per-user IPs
+# (ifconfig-pool-persist) are incompatible with that — do not re-enable.
+duplicate-cn
 
 # Split tunnel: only the AD sites + transfer net ride the VPN.
 push "route 192.168.20.0 255.255.255.0"
 push "route 192.168.7.0 255.255.255.0"
 push "route 172.31.255.0 255.255.255.0"
 
-# All client DNS goes to Technitium on this box (block-outside-dns stops
-# Windows from leaking AD lookups to the local LAN resolver).
+# ALL client DNS goes to Technitium. Deliberately NO "dhcp-option DOMAIN"
+# or DOMAIN-SEARCH here: in OpenVPN3 clients (Connect on macOS/iOS/
+# Android/Windows) those options MEAN split-DNS — pushing them scopes the
+# VPN DNS to just those domains. With only DNS pushed, 172.31.8.1 becomes
+# the default resolver for every query. ADAPTER_DOMAIN_SUFFIX sets the
+# Windows connection-specific suffix (short names like "ahdc01" still
+# resolve) without triggering split-DNS. block-outside-dns additionally
+# stops Windows from leaking queries to the local LAN resolver.
 push "dhcp-option DNS 172.31.8.1"
-push "dhcp-option DOMAIN ad.atlashorizon.net"
-push "dhcp-option DOMAIN-SEARCH ad.atlashorizon.net"
-push "dhcp-option DOMAIN-SEARCH ad.calliecorner.net"
-push "dhcp-option DOMAIN-SEARCH ad.oswaldtheotter.net"
-push "dhcp-option DOMAIN-SEARCH ad.trochalakis.net"
+push "dhcp-option ADAPTER_DOMAIN_SUFFIX ad.atlashorizon.net"
 push "block-outside-dns"
 
 # PKI — server certificate only (offline CA, see pki/README.md);
@@ -44,8 +51,12 @@ plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
 verify-client-cert none
 username-as-common-name
 hand-window 120        # allow time for the Duo push round-trip
-reneg-sec 0            # no mid-session TLS renegotiation (would re-prompt Duo)
-auth-gen-token 43200   # reconnects within 12h reuse a token instead of a new push
+# Hourly rekey + 12h auth token: renegotiations are satisfied silently by
+# the pushed token (no mid-session Duo prompts); a fresh password + push
+# is only required once the token expires. (auth-gen-token requires a
+# non-zero reneg-sec — do not set reneg-sec 0 here.)
+reneg-sec 3600
+auth-gen-token 43200
 
 keepalive 10 60
 explicit-exit-notify 1
@@ -60,6 +71,15 @@ group nogroup
 persist-key
 persist-tun
 
+# Register each client as <username>.$VPN_DNS_ZONE (A + PTR) in Technitium
+# on connect, clean up on disconnect. Invoked via sh so the mounted script
+# needs no exec bit; env (TECHNITIUM_ADMIN_PASSWORD, VPN_DNS_ZONE) comes
+# from the container environment.
+script-security 2
+learn-address "/bin/sh /etc/openvpn/learn-address.sh"
+
 status /var/lib/openvpn/status.log 30
-management 127.0.0.1 7505
+# Unix socket (root-only) instead of a passwordless TCP port:
+#   docker compose exec openvpn sh -c "socat - UNIX:/var/lib/openvpn/mgmt.sock"
+management /var/lib/openvpn/mgmt.sock unix
 verb 3