Hi All,
I've been using openvpn now for almost a year in production and its been great, really stable I'm very happy with it. On that note I'd like to continue to use it and thus also expand upon my current set-up.
Current set-up (Version 2.1) - SERVER
Proto tcp
dev tun
server 10.0.0.0 255.255.255.0
duplicate-cn
push (some routes)
(few other bits but I don't think required info in here)
So I am using 'duplicate-cn' so that I don't have to generate client comman-name certificates on each server (a temporary things that has lasted longer than planned), but now I've just added another client to the mix which I'd like to somehow firewall off or segregate from the other VPN clients. This particular client I want to be able to provide more access compared to the other servers. I've looked at using ccd dir for per client config and created a client key with different comman-name compared to the rest which al works fine. However I'm still not sure how I can firewall things off. As I want to do this whilst using a singular openvpn instance the only thing i could think of would be somehow using ifconfig-pool which is only executed in the client that I want to give special treatment using the ccd dir file for that client and then setting up a iptables stuff to sort out the firewall as if using ipconfig-pool then I've got something to say I know the connection is coming down the wire on a subnet that it only used by these special clients, so I can set-up iptables just for that special pool of IPs. But i couldn't get that working..
What's the best method I could used based on the server configuration that would allow me to set-up a sort of firewall or network segregation dependent on the client conman name that's connecting to the server?
Many Thanks,
M
