Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ive set up an OpenVPN server at my place and handed out a certificate to a client who has an openvpn client at his place.

I need require that he should be able to connect to the vpn server only from one IP address (his current one). How can I do this?

share|improve this question

migrated from stackoverflow.com May 30 '10 at 15:31

This question came from our site for professional and enthusiast programmers.

2  
what's the OS - is openvpn running under linux/windows/sth else? –  pQd May 30 '10 at 16:58

2 Answers 2

I don't believe OpenVPN has any built-in method to control access based on IP address. You probably will need to use either your border firewall, or the firewall for that host OS to limit access as required.

Personally, I am not sure that it is worth the effort. If you have a good set of keys and HMAC authentication there is very low chance of anyone else being able to get it.

share|improve this answer
    
sounds like the client may be using the host as a bridge point for their private net, in which case if the vpnclient is moved to another location, the cert will still be valid, but the host may not be in the appropriate and safe network. –  Jimsmithkka Sep 1 '10 at 6:00

You can use /etc/hosts.deny and /etc/hosts.allow as follows if your system supports TCP Wrapper and your openvpn server is linked against libwrap (you can check with this command: ldd /usr/sbin/openvpn | grep wrap):

/etc/hosts.allow

openvpn: 192.0.0.1

/etc/hosts.deny

openvpn: ALL

Replace 192.0.0.1 with his internet-facing IP address. This configuration assumes he's the only person connecting with openvpn, though you could add more IPs as needed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.