I have multiple OpenVPN servers which have clients like slave-1 and slave-2 which have access only to the OpenVPN server itself. I have a dedicated CA server for creating new users to the system. I want to implement support for users like master-1 and master-2 which have access to the slave clients.

I read that, if I enable client-to-client on OpenVPN I can't use firewall, because the client to client networking will be done inside OpenVPN without reaching host layer.

I read that I can create client specific modifications to the server.conf using client-config-dir and certificate common name, but I can't find a way to do the modifications using prefixes like "master-*".

To get started solving this issue I tried to allow all networking between all clients without enabling client-to-client on OpenVPN by running these commands on the OpenVPN server:

echo 1 > /proc/sys/net/ipv4/ip_forward
sudo iptables -I FORWARD --src --dst -j ACCEPT

And these commands on the OpenVPN client:

sudo ip route del via
sudo ip route add via dev tun0

After that the OpenVPN client was still unable to connect to other clients.


This is done via appropriate iroute directives set via the "CCD" mechanism (per-client configuration bits).

See this for more info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.