I have set up an OpenVPN Server and it is working so far. I have the following subnet in my network,,, and When I connected to my VPN, I can ping all the 3 subnets, no problem. How do I limit the subnet access from the server side ? I don't need ccd configuration because is intended for all clients. I just want to limit access to subnet 10.200.1/24 and 10.200.2/24 globally if connected.

The configuration below works where the client is not able to access 10.200.3/24 when connected because the server did not push the route to the client. But when client manually adds the route to their machine, they can technically connect to it.

How do I enforce from the server-side what subnet is allowed to be accessed?


port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
ifconfig-pool-persist ipp.txt
push "route"
push "route"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
status openvpn-status.log
verb 3
crl-verify crl.pem

Your VPN server is a IP router (which does packet forwarding), where packets might be filtered (be forwarded or not forwarded). This is done with a firewall. For example, if server is Linux, you add:

iptables -I FORWARD 1 -s -d -j REJECT

The -I ... 1 will install the rule before anything else in the chain, I crafted it like this to be sure it would work right as is, regardless of what is already in the firewall. This might be not optimal. Please, adjust the rule as needed. Just make sure it appears before any permitting rule which matches packets from VPN clients.

This filtering also can be done with OpenVPN plugin, but it is much harder to achieve.

  • That works !!. Thanks alot. – jlim Jan 6 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.