3

I have an OpenVPN server running on a Debian box. What I'd like to do is to block all traffic between clients connected to that OpenVPN server.

The server has a local IP of 10.10.10.1 and the clients get IPs between 10.10.10.2-10.10.10.8.

I tried using iptables, but seems that the traffic between the clients never leave tun0 so I cannot block it.

What can I do? Is there some iptables rule that can block traffic inside an interface? (tun0)

client-to-client is NOT enabled in server.conf, but for some reason users can still ping each other and communicate with each other.

  • Although I can't explain why you are having this problem, there may be a way around it. Apparently (from what I've read), OpenVPN has a built in packet filter that can control this type of activity. I won't go into detail, because I've never used it. But it is documented and easy to find with Google. – Ryan Babchishin Oct 2 '15 at 8:28
  • Please post your full openvpn configs and logs. Both from the server and clients. – iprok Oct 4 '15 at 19:22
2

Seems that you have "client-to-client" option turned on in you server openvpn config. You should just remove it cause openvpn doesn't route client-to-client traffic by default.

Here is text from man-page of openvpn:

client-to-client

Because the OpenVPN server mode handles multiple clients through a single tun or tap interface, it is effectively a router. The --client-to-client flag tells OpenVPN to internally route client-to-client traffic rather than pushing all client-origi‐ nating traffic to the TUN/TAP interface.

When this option is used, each client will "see" the other clients which are currently connected. Otherwise, each client will only see the server. Don't use this option if you want to firewall tunnel traffic using custom, per-client rules.

1

Add a rule on the server to block all traffic between clients, e.g.:

sudo iptables -I FORWARD --src 10.8.0.0/24 --dst 10.8.0.0/24 -j DROP
  • The question clearly states that this has already been tried, and it did not work. – kasperd Oct 18 '16 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.