spartan1833
Hi,
I have a site-to-site routed vpn (linux openvpn routers on both sides) - site A is the local "server" side and site B is the remote "client" side. Site A has some resources on the LAN behind the server and also acts as the Internet gateway for site B (ala redirect-gateway). Site B has 10 computers assigned to the site and are allowed access to the resources behind the site A server. All Internet sccess for site B is routed through site A; no local Internet access at site B is allowed.
I've been asked to provide Internet access for a transient group of "guest devices" at site B. The Internet needs to be routed in the same manner as what I'm doing for the normal static computers at site B but they should not have access to the resources behind the site A server. The guest devices will access the site B vpn router via a separate subnet from the regular site B computers as traffic from the guest devices needs to be kept separate from the regular computer subnet (firewalling handled separately). Connection to the site B vpn router for these guest subnet is handled by an additional network adapter.
I read the section in the HOWTO about configuring client-specific rules but that appears to be geared towards road warrior configuration. I considered running a second tunnel but bandwidth at site B is limited (sat link) so I'm wondering if anyone has any advice on a practical way to do this. To summarize:
- The regular site B computers should have redirected Internet and access to resources behind the site A server.
- The "guest" devices (laptops, tablets, etc) should have redirected Internet but no access to other site A resources.
Thanks, Happy New Year!
