IP range based on user... it's possible?

zeycron

Hello,

Is it possible to associate a range of IP addresses to specific users?

typically all my users (Common Name) whose name begins with "user-manager-" would have the range 192.168.0.100-192.168.0.150. Others would have 192.168.0.151-192.168.0.200

The idea is to filter connections (with iptables) based on user

thank you very much
good weekend

config server :
----------------
debian squeeze
openvpn 2.1 (mode bridge)

local W.X.Y.Z
port 1194
proto udp
dev tap0
ca ca.crt
cert vpn.crt
key vpn.key
dh dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.0.99 255.255.255.0 192.168.0.100 192.168.0.200
client-config-dir /etc/openvpn/ccd
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS W.X.Y.T"
push "dhcp-option DNS W.X.Y.U"
push "explicit-exit-notify 3"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
crl-verify /etc/openvpn/crl.pem
comp-lzo
max-clients 50
chroot jail
user openvpn
group openvpn
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 4
mute 10
username-as-common-name
plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn
script-security 2
auth-user-pass-verify /etc/openvpn/test.sh via-env # verif common name / user

Mimiko

This is better done by assigning a static IP per user using common name and user name combination, then filter using iptables by IP.

zeycron

Thank you but this is not possible because I have too many potential users but very few that simultaneously connect ...

I thought to make two openvpn instance (on the same machine) but I do not think it's super clean ..

So I hesitate to create a second vm ..

thank you for help

dropje

I would recommend using learn-address to dynamically update your iptables firewall using an access policy. All the info required to do this will be availabe in the script as arguments (common_name, ip_address, action)