Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is it possible to block a user's access to every server / IP except one specific server once he is logged in by OpenVPN, and how can I implement that?

The other users should not be affected by this restriction.

Thank you.

share|improve this question

If you use x.509 certificates for every different user, you are able to assign a unique ip addresse from the openvpn remote ip pool. See option --ifconfig-pool-persist file in OpenVPN 2.2 Manual .

After this, you are able to use iptables as usual.

share|improve this answer

If your openvpn is configured to use routing not bridging you can do this by pushing them only a host route /32 based on the certificate they send. The openvpn sample configuration has an example of how you can set this up.

share|improve this answer
Just pushing a specific route will not prevent the user from accessing other hosts. This user could still add the correct route to its computer and access those servers. The only way to prevent an access is by using the server firewall. – Vincent Robert Oct 20 '11 at 11:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.