59 lines
1.9 KiB
Markdown
59 lines
1.9 KiB
Markdown
|
Based on my research, here's how the VPN server can extract MAC addresses:
|
||
|
|
|
||
|
|
MAC Address Extraction Methods
|
||
|
|
|
||
|
|
1. IV_HWADDR Environment Variable (Primary Method)
|
||
|
|
|
||
|
|
- Client Configuration: Add push-peer-info to client .ovpn config
|
||
|
|
- Environment Variable: IV_HWADDR contains the client's MAC address
|
||
|
|
- Format: Standard MAC format (e.g., 00:FF:01:02:03:04)
|
||
|
|
|
||
|
|
2. Client Configuration Requirements
|
||
|
|
|
||
|
|
# In client.ovpn file
|
||
|
|
push-peer-info
|
||
|
|
|
||
|
|
3. Server Script Access
|
||
|
|
|
||
|
|
import os
|
||
|
|
|
||
|
|
def extract_mac_address():
|
||
|
|
# Primary method - IV_HWADDR from push-peer-info
|
||
|
|
mac_address = os.environ.get('IV_HWADDR')
|
||
|
|
|
||
|
|
if mac_address:
|
||
|
|
return mac_address.strip()
|
||
|
|
|
||
|
|
# Fallback - check other environment variables
|
||
|
|
return None
|
||
|
|
|
||
|
|
Important Considerations
|
||
|
|
|
||
|
|
Client Compatibility Issues:
|
||
|
|
|
||
|
|
- OpenVPN2 clients: Generally send MAC addresses reliably
|
||
|
|
- OpenVPN3 clients: May send UUID strings instead of MAC addresses
|
||
|
|
- Older clients: May not provide MAC address at all
|
||
|
|
|
||
|
|
Alternative Approaches:
|
||
|
|
|
||
|
|
1. TAP Mode (Layer 2):
|
||
|
|
- Use --dev tap instead of --dev tun
|
||
|
|
- MAC addresses available through --learn-address script
|
||
|
|
- More complex network setup required
|
||
|
|
2. Client Certificate Binding:
|
||
|
|
- Embed MAC address in certificate Common Name or Subject Alt Name
|
||
|
|
- More secure but requires certificate management per device
|
||
|
|
3. Custom Client Reporting:
|
||
|
|
- Modify client to report MAC through custom authentication
|
||
|
|
|
||
|
|
Recommended Implementation
|
||
|
|
|
||
|
|
For your VPN access server, the most practical approach is:
|
||
|
|
|
||
|
|
1. Require push-peer-info in all client configurations
|
||
|
|
2. Extract from IV_HWADDR environment variable in client-connect script
|
||
|
|
3. Handle missing MAC addresses gracefully (log and potentially deny access)
|
||
|
|
4. Document client requirements for users/administrators
|
||
|
|
|
||
|
|
This method integrates seamlessly with your existing MySQL-based validation system in access/auth.py.
|