Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is it possible to block a user's access to every server / IP except one specific server once he is logged in by OpenVPN, and how can I implement that?

The other users should not be affected by this restriction.

Thank you.

share|improve this question
add comment

2 Answers 2

If you use x.509 certificates for every different user, you are able to assign a unique ip addresse from the openvpn remote ip pool. See option --ifconfig-pool-persist file in OpenVPN 2.2 Manual .

After this, you are able to use iptables as usual.

share|improve this answer
add comment

If your openvpn is configured to use routing not bridging you can do this by pushing them only a host route /32 based on the certificate they send. The openvpn sample configuration has an example of how you can set this up.

share|improve this answer
2  
Just pushing a specific route will not prevent the user from accessing other hosts. This user could still add the correct route to its computer and access those servers. The only way to prevent an access is by using the server firewall. –  Vincent Robert Oct 20 '11 at 11:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.