Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have three segments behind openvpn server: DMZ (192.168.1.x), Dev (192.168.2.x) and PROD (192.168.3.x). There are two groups of users: one group can connect to all segments from openvpn, while I want to restrict the other users to the Dev segment. What is the best way of doing this?

Openvpn users are assigned IP addresses in 10.10.11.x network.

share|improve this question
up vote 3 down vote accepted

The best way to do this is to give each group its own /24 subnet or break up your and do some iptables magic to block dev users..

But I think the best thing to do, if your network supports it, is vlan tag each subnet. Give the dev users their own /24 in openvpn and then some firewall rules to only allow the dev vlan to be able to connect to certain other lans.

share|improve this answer

For openvpn there is a switch called --learn-address, that can be used to generate rules...

In this script you basically you check the CN and add/remove iptables rules for the IP.

extract from the openvpn MAN:

  --learn-address cmd
          Run  script  or  shell  command  cmd  to validate client virtual
          addresses or routes.

          cmd will be executed with 3 parameters:

          [1] operation -- "add", "update", or "delete" based  on  whether
          or  not the address is being added to, modified, or deleted from
          OpenVPN's internal routing table.
          [2] address -- The address being learned or unlearned.  This can
          be  an IPv4 address such as "", an IPv4 subnet such
          as "", or an ethernet MAC address (when --dev tap
          is being used) such as "00:FF:01:02:03:04".
          [3] common name -- The common name on the certificate associated
          with the client linked to this address.  Only present for  "add"
          or "update" operations, not "delete".

          On  "add"  or  "update" methods, if the script returns a failure
          code (non-zero), OpenVPN will reject the address  and  will  not
          modify its internal routing table.

          Normally, the cmd script will use the information provided above
          to set appropriate firewall entries on the  VPN  TUN/TAP  inter‐
          face.  Since OpenVPN provides the association between virtual IP
          or MAC address and the client's authenticated  common  name,  it
          allows  a user-defined script to configure firewall access poli‐
          cies with regard to the client's high-level common name,  rather
          than the low level client virtual addresses.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.