When using a TUN (layer 3) OpenVPN server with
client-to-client disabled, my clients can still talk to each other.
The client-to-client config should prevent this according to the documentation:
Uncomment out the client-to-client directive if you would like connecting clients to be able to reach each other over the VPN. By default, clients will only be able to reach the server.
Why can the clients continue to communicate to each other when this option is disabled?
Here is my server conf:
port 443 proto tcp dev tun ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh4096.pem topology subnet server 10.10.201.0 255.255.255.128 ifconfig-pool-persist ipp.txt crl-verify /etc/openvpn/keys/crl.pem push "route [omitted]" push "dhcp-option DNS [omitted]" keepalive 10 120 comp-lzo user nobody group nogroup persist-key persist-tun plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login cipher AES-256-CBC tls-auth /etc/openvpn/keys/pfs.key 0 verb 4