Howto Route Only Specific Part of Subnet

tushar.sharma

Hello All,

I have configured openvpn server and client and pushed routes from server to client and added route of client
using ccd directives,

I am able to access all machines on other side subnet.

How can I restrict routes to allow access to only specific machines and not all to get accessed from subnet of client to subnet of server.

Thanking You
tushar

george

I did this using iptables:

I can't recall the commands, but here are examples from by iptables backup file:

This line allows traffic from the 10.8.1.0/24 subnet to reach the host at 192.168.1.12

-A FORWARD -s 10.8.1.0/255.255.255.0 -d 192.168.1.12 -i tun0 -j ACCEPT

This line drops traffic to the rest of the 192.168.1.0/24 subnet from the 10.8.1.0/24 subnet:

-A FORWARD -s 10.8.1.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -i tun0 -j DROP

So, you'll need an accept rule for each VPN subnet, (or particular client), for each host, (or hosts on a subnet), and then a drop rule for each VPN subnet and LAN subnet you are pushing routes for.

tushar.sharma

Hello George,

i have following Scenario..,,

(subnet -- 192.168.3.0/24)-------client()(Virtual IP 10.8.1.1-2)------------(Virtual ip 10.8.1.5-6)-server-------------(subnet 192.168.2.0/24)

i have written rule you have guided but still I am able to ping all pc behind server from all pc behind client.

I have seen in wireshark source ip of packet remains(192.168.3.0/24) and not the virtual ip I am assigning...

Mimiko

The same way you can block access from 192.168.3.0:

-A FORWARD -s 192.168.3.0/255.255.255.0 -d 192.168.2.X -i tun0 -j ACCEPT # ip of every server side computer
-A FORWARD -s 192.168.3.0/255.255.255.0 -d 192.168.2.0/255.255.255.0 -i tun0 -j DROP