I have set up an OpenVPN Server and it is working so far. I have the following subnet in my network, 10.200.1.0/24
, 10.200.2.0/24
, and 10.200.3.0/24
. When I connected to my VPN, I can ping all the 3 subnets, no problem. How do I limit the subnet access from the server side ? I don't need ccd
configuration because is intended for all clients. I just want to limit access to subnet 10.200.1/24
and 10.200.2/24
globally if connected.
The configuration below works where the client is not able to access 10.200.3/24
when connected because the server did not push the route to the client. But when client manually adds the route to their machine, they can technically connect to it.
How do I enforce from the server-side what subnet is allowed to be accessed?
server.conf
local 10.200.0.8
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.200.1.0 255.255.255.0"
push "route 10.200.2.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
explicit-exit-notify