gerim
Hi,
I'm new to OpenVPN and current evaluating if is the right tool for my need:
I want to implement the following setup. I want 2 x VPNs. The Clients are installed front up with certificates and openVPN Clients, but later -- after they are shipped -- it will be determined whether the client may access VPN #1 or VPN #2. So I'm not able to change the configuration on the client (eg. the Port in the openvpn config file). The clients should be identified using their certificates and I do need some kind of "list", where I can say: Client A => VPN 1, Client B => VPN 2 ... etc.
How can I implement such as setup? Is OpenVPN the right tool to so so?
Best, Gerald
janjust
sure this is possible - set up a single PKI (ca.crt, server cert, client certs) and set up the openvpn servers to use a 'tls-verify' script. This script can then check the incoming certificate names (DNs, in cert speak) and can then allow or deny access based on the client certificate name. We use a setup like this.
gerim
Thanks for the hint with tls-verify. That should help. Regarding the VPNs themself. Do I really need two servers instances or is there an option to have two VPNs on on server?
gerim
I forgot to mention: I'm not able to change the Port in the config-File on the Client. Thus if I have two instances of openVPN running, they would have two different Ports. Can I overcome this issue somehow?
janjust
first you say you want 2 VPNs and now you don't ?
each UDP or TCP port requires a separate instance of OpenVPN; it IS possible to run one instance on IP1:PORT and the other on IP2:PORT .
