1

Here is a quick diagram of what i'm trying to configure

openvpndiagram

I have multiple clients connecting to my VPN Server (from 10.0.1.2 to 10.0.25.2). Each LAN behind the clients are always the same : 192.168.1.0/24 and devices use the client as default gateway. I need that each remote user have only access to some devices behind each client

What kind of configuration need I make to get access to LAN device via an address in the VPN subnet ?

for example :

  • device1-behind-client_001 : 192.168.169.125/24 <=> 10.0.1.101
  • device2-behind-client_001 : 192.168.169.126/24 <=> 10.0.1.102
  • device3-behind-client_001 : 192.168.169.127/24 <=> 10.0.1.103
  • device1-behind-client_002 : 192.168.169.125/24 <=> 10.0.2.101
  • device1-behind-client_003 : 192.168.169.125/24 <=> 10.0.3.101

Each client are already connected to the server and configured with tun interface.


Edit

iptables on my OpenVPN server

iptables -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A POSTROUTING -s 10.0.0.0/16 -o eth0 -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT

iptables on client_001 (example)

iptables -t nat -A PREROUTING -d 10.0.1.102/32 -i eth0 -j DNAT --to-destination 192.168.1.126
iptables -t nat -A POSTROUTING -s 192.168.1.126/32 -o eth0 -j SNAT --to-source 10.0.1.102/32

With this configuration, if a remote user is connected to the server, can he access the 192.168.1.126 device on the client_001 lan via this address 10.0.1.102 ?

1 Answer 1

1

Disable 'client-to-client' option in config and use firewall/iptables to filter traffic.

2
  • Uncomment out the client-to-client directive if you would like connecting clients to be able to reach each other over the VPN. By default, clients will only be able to reach the server. It means that my client won't see each other and i'm fine with that. In my example I 'translate' LAN ip address to VPN subnet ip address, should I do this translation via iptables/firewall on my clients ? Does my server be aware of this ?
    – Thomas N.
    Apr 20, 2016 at 7:17
  • 1
    backreference.org/2010/05/02/… traffic will be visible on tun device so you can use iptables to filter it warhewer you like Apr 20, 2016 at 8:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .