OpenVPN Community Limiting Subnet Access

Question

I have set up an OpenVPN Server and it is working so far. I have the following subnet in my network, 10.200.1.0/24, 10.200.2.0/24, and 10.200.3.0/24. When I connected to my VPN, I can ping all the 3 subnets, no problem. How do I limit the subnet access from the server side ? I don't need ccd configuration because is intended for all clients. I just want to limit access to subnet 10.200.1/24 and 10.200.2/24 globally if connected.

The configuration below works where the client is not able to access 10.200.3/24 when connected because the server did not push the route to the client. But when client manually adds the route to their machine, they can technically connect to it.

How do I enforce from the server-side what subnet is allowed to be accessed?

server.conf

local 10.200.0.8
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.200.1.0 255.255.255.0"
push "route 10.200.2.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
explicit-exit-notify

Answer 1

Your VPN server is a IP router (which does packet forwarding), where packets might be filtered (be forwarded or not forwarded). This is done with a firewall. For example, if server is Linux, you add:

iptables -I FORWARD 1 -s 10.8.0.0/24 -d 10.200.3.0/24 -j REJECT

The -I ... 1 will install the rule before anything else in the chain, I crafted it like this to be sure it would work right as is, regardless of what is already in the firewall. This might be not optimal. Please, adjust the rule as needed. Just make sure it appears before any permitting rule which matches packets from VPN clients.

This filtering also can be done with OpenVPN plugin, but it is much harder to achieve.