1

First of all, I'm a total noob with VPNs. I only managed to install OpenVPN by following a tutorial. The clients can see each other and everything seems to be working without a hitch.

However, the network in question is intended solely for client-to-client use and I'd very much like to restrict access to the server's own network and services(www, mysql, smb etc.). In other words the VPN clients should only have access to each other through VPN.

I'm not even completely sure if this is completely possible, but I figure there must be a better way than configuring every service to block a certain ip range..?

I'm running Debian Wheezy with pretty much default networking and OpenVPN config.

Improve this question
1
  • It just occurred to me, would a simple iptables rule that drops everything from 10.8.0.* work? I had success trying it out on my local server but I have no idea if it would cause problems at some point.
    – Pichan
    May 21, 2014 at 7:21

1 Answer 1

Reset to default
0

Hmm, just off the top of my head... and without reading the OpenVPN Manual...

I would put all my users into their own Subnet. if your server is 192.168.0.1, then you'd might put your users into their own subnet (i.e. 192.168.1.1-244).

you could then make sure that all your services/daemons are bound to a specific address, and not * or 0.0.0.0. its normally a good idea to know what interfaces your services are bound to anways

as long as OpenVPN does not push a route to the client to transverse these subnets, they should not be able to connect to your backend services (as far as I know)

furthermore, IPTables could certainly be your second line of defense -

you could put a rule at the top of your INPUT chain that drops all connections from 10.8.0.*, and anything services they need access to (i.e squid), you could just use the IPTables "redirect" method

hopefully this helps

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .