Per user iptables / fw rules

alexs_yb

Hi

I want to be able to apply firewall rules based on the user that has logged on/connected.

But openvpn drops down to nobody/nogroup.
I know openvpn can create routing rules. is there a way to do iptables rules or run a script with the right privileges

Thanks

krzee

alexs_yb wroteHi

I want to be able to apply firewall rules based on the user that has logged on/connected.

But openvpn drops down to nobody/nogroup.
I know openvpn can create routing rules. is there a way to do iptables rules or run a script with the right privileges

Thanks

you could configure sudo to give the openvpn user access to the needed commands (without requiring a password)

mwandelaar

The openvpn-cookbook from JanJust Keijzer has an extensive chapter about this.
Basically you don't drop privileges to user nobody as you really need the root-rights to be able to change iptable rules.

Giving sudo rights without password (there's nobody to type the password) to the openvpn-user essentially gives openvpn root-rights and therefor there's no difference anymore in dropping privileges or not.

alexs_yb

I might try the sudo route to start with.

I can at least limit the commands and the arguments to the commands with sudo.

Thanks