OpenVPN: Limiting Client Access to Specific Destination Clients
I have two OpenVPN client (ovpn_dest1, ovpn_dest2) which run continuously and have a private network (10.60.10.0/24 & 10.60.20.0/24) which I want to access from two Windows OpenVPN clients.
The windows OpenVPN clients (ovpn_user1, ovpn_user2) however should only be able to access their respective networks (either 10.60.10.0/24 or 10.60.20.0/24).
With ovpn_user1 access to ovpn_dest1 (10.60.10.0/24) and ovpn_user2 should only able to access ovpn_dest2 (10.60.20.0/24).
The current setup uses the client-to-client directive in the host OpenVPN server.conf file, which is needed to allow the Windows clients to talk to the ovpn_dest1/2 and their network devices (device1_1/device1_2/etc).
Unfortunately this client-to-client directive means that a Windows client can also access all ovpn_dest1/2 clients which is not wanted from a security point of view.
Network and IP designations:
ovpn_dest1 - 10.60.10.2
device1_1 - 10.60.10.3
device1_2 - 10.60.10.4
ovpn_dest2 - 10.60.20.2
device2_1 - 10.60.20.3
ovpn_user1 - 10.60.10.0/24
ovpn_user2 - 10.60.20.0/24
/etc/openvpn/server/server.conf:
local 188.166.226.159
port 1194
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 67.207.67.3"
push "dhcp-option DNS 67.207.67.2"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify
log-append /var/log/openvpn.log
client-to-client
client-config-dir ccd
/etc/openvpn/server/ccd/ovpn_dest1
route 10.60.10.0 255.255.255.0
iroute 10.60.10.0 255.255.255.0
push "route 10.60.10.0 255.255.255.0"
/etc/openvpn/server/ccd/ovpn_dest2
route 10.60.20.0 255.255.255.0
iroute 10.60.20.0 255.255.255.0
push "route 10.60.20.0 255.255.255.0"
I can also connect to all of the following devices from any windows OpenVPN client (ovpn_user1/ovpn_user2):
http://10.8.0.2/ (ovpn_dest1)
http://10.8.0.3/ (ovpn_dest2)
http://10.60.10.2/ (ovpn_dest1)
http://10.60.20.2/ (ovpn_dest2)
10.60.10.3 (device1_1)
However I want to limit the access for windows clients such that a given client can only access its specific ovpn_destN network.
I have tried using iptables, however I am no expert in this, and it seems the client-to-client directive in the server.conf file effectively overrides anything attempted in iptables to block a route between a source and destination. (The directive "client to client networking will be done inside OpenVPN without reaching host layer"). It seems I might have to remove "client-to-client" from the server.conf to limit connections, but I have been unable to establish communications when this line is removed.
I have considered using multiple OpenVPN instances (one for each set of ovpn_destN, ovpn_userN) however with many dozens of instances this may not be ideal. Although multiple networks will likely not be accessed frequently concurrently.
What (and how) is the best way of limiting a Windows client to a specific destination network?
