3

I have an OpenVPN server running on a Debian box. What I'd like to do is to block all traffic between clients connected to that OpenVPN server.

The server has a local IP of 10.10.10.1 and the clients get IPs between 10.10.10.2-10.10.10.8.

I tried using iptables, but seems that the traffic between the clients never leave tun0 so I cannot block it.

What can I do? Is there some iptables rule that can block traffic inside an interface? (tun0)

client-to-client is NOT enabled in server.conf, but for some reason users can still ping each other and communicate with each other.

Improve this question
2
  • Although I can't explain why you are having this problem, there may be a way around it. Apparently (from what I've read), OpenVPN has a built in packet filter that can control this type of activity. I won't go into detail, because I've never used it. But it is documented and easy to find with Google.
    – Ryan Babchishin
    Oct 2, 2015 at 8:28
  • Please post your full openvpn configs and logs. Both from the server and clients.
    – iprok
    Oct 4, 2015 at 19:22

2 Answers 2

Reset to default
2

Seems that you have "client-to-client" option turned on in you server openvpn config. You should just remove it cause openvpn doesn't route client-to-client traffic by default.

Here is text from man-page of openvpn:

client-to-client

Because the OpenVPN server mode handles multiple clients through a single tun or tap interface, it is effectively a router. The --client-to-client flag tells OpenVPN to internally route client-to-client traffic rather than pushing all client-origi‐ nating traffic to the TUN/TAP interface.

When this option is used, each client will "see" the other clients which are currently connected. Otherwise, each client will only see the server. Don't use this option if you want to firewall tunnel traffic using custom, per-client rules.

Improve this answer
1

Add a rule on the server to block all traffic between clients, e.g.:

sudo iptables -I FORWARD --src 10.8.0.0/24 --dst 10.8.0.0/24 -j DROP
Improve this answer
1
  • The question clearly states that this has already been tried, and it did not work.
    – kasperd
    Oct 18, 2016 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .