2

I have multiple OpenVPN servers which have clients like slave-1 and slave-2 which have access only to the OpenVPN server itself. I have a dedicated CA server for creating new users to the system. I want to implement support for users like master-1 and master-2 which have access to the slave clients.

I read that, if I enable client-to-client on OpenVPN I can't use firewall, because the client to client networking will be done inside OpenVPN without reaching host layer.

I read that I can create client specific modifications to the server.conf using client-config-dir and certificate common name, but I can't find a way to do the modifications using prefixes like "master-*".

To get started solving this issue I tried to allow all networking between all clients without enabling client-to-client on OpenVPN by running these commands on the OpenVPN server:

echo 1 > /proc/sys/net/ipv4/ip_forward
sudo iptables -I FORWARD --src 10.8.0.0/24 --dst 10.8.0.0/24 -j ACCEPT

And these commands on the OpenVPN client:

sudo ip route del 10.8.0.1/32 via 10.8.0.53
sudo ip route add 10.8.0.0/24 via 10.8.0.53 dev tun0

After that the OpenVPN client was still unable to connect to other clients.

user1937459
  • 121
  • 2

1 Answers1

0

This is done via appropriate iroute directives set via the "CCD" mechanism (per-client configuration bits).

See this for more info.

kostix
  • 1,150
  • 1
  • 7
  • 13