1

Here is a quick diagram of what i'm trying to configure

openvpndiagram

I have multiple clients connecting to my VPN Server (from 10.0.1.2 to 10.0.25.2). Each LAN behind the clients are always the same : 192.168.1.0/24 and devices use the client as default gateway. I need that each remote user have only access to some devices behind each client

What kind of configuration need I make to get access to LAN device via an address in the VPN subnet ?

for example :

  • device1-behind-client_001 : 192.168.169.125/24 <=> 10.0.1.101
  • device2-behind-client_001 : 192.168.169.126/24 <=> 10.0.1.102
  • device3-behind-client_001 : 192.168.169.127/24 <=> 10.0.1.103
  • device1-behind-client_002 : 192.168.169.125/24 <=> 10.0.2.101
  • device1-behind-client_003 : 192.168.169.125/24 <=> 10.0.3.101

Each client are already connected to the server and configured with tun interface.

Edit

iptables on my OpenVPN server

iptables -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A POSTROUTING -s 10.0.0.0/16 -o eth0 -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT

iptables on client_001 (example)

iptables -t nat -A PREROUTING -d 10.0.1.102/32 -i eth0 -j DNAT --to-destination 192.168.1.126
iptables -t nat -A POSTROUTING -s 192.168.1.126/32 -o eth0 -j SNAT --to-source 10.0.1.102/32

With this configuration, if a remote user is connected to the server, can he access the 192.168.1.126 device on the client_001 lan via this address 10.0.1.102 ?

Thomas N.
  • 121
  • 1
  • 6

1 Answers1

1

Disable 'client-to-client' option in config and use firewall/iptables to filter traffic.

Dariusz Bączkowski
  • 244
  • 1
  • 8
  • `Uncomment out the client-to-client directive if you would like connecting clients to be able to reach each other over the VPN. By default, clients will only be able to reach the server.` It means that my client won't see each other and i'm fine with that. In my example I 'translate' LAN ip address to VPN subnet ip address, should I do this translation via iptables/firewall on my clients ? Does my server be aware of this ? – Thomas N. Apr 20 '16 at 07:17
  • 1
    http://backreference.org/2010/05/02/controlling-client-to-client-connections-in-openvpn/ traffic will be visible on tun device so you can use iptables to filter it warhewer you like – Dariusz Bączkowski Apr 20 '16 at 08:28