Filtering traffic between clients

KAT

Hello
I'm trying to set up a simple openvpn server with restricted client-to-client policy. I want to block any traffic between clients, except of few administrative accounts. Administrators must have full access to all vpn clients.
I've seen this article:
http://openvpn.net/index.php/open-source/documentation/howto.html#policy
but it doesn't work.
If I enable client-to-client in servers configuration, clients can access each other without problems, so I assume the basic server and client configuration is correct.
but if I disable client-to-client and apply iptables rules described in article above clients cannot access each other:

# Employee rule
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.66.4.4 -j ACCEPT

# Sysadmin rule
iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 10.66.4.0/24 -j ACCEPT

I've also enabled routing in my sysctl.conf.

What am I missing?

KAT

Yes, so i have a firewall - iptables (just like in this sample)

KAT

Hi
OK, so I enabled client-to-client.
Right now i can ping client-server, server-client and client-client.
But if i try to setup my policy with iptables:

iptables -A INPUT -s 10.8.0.0/24 -d 10.8.0.0/24 -j DROP
iptables -A FORWARD -s 10.8.0.0/24 -d 10.8.0.0/24 -j DROP

the only acheivement is client cannot ping server (and vice versa), but client still can ping client.

server.conf:

port 667
proto tcp
dev tun
ca /etc/openvpn/rsa/keys/ca.crt
cert /etc/openvpn/rsa/keys/server.crt
key /etc/openvpn/rsa/keys/server.key
dh /etc/openvpn/rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/ccd/ #empty for now - KAT
client-to-client
crl-verify /etc/openvpn/rsa/keys/crl.pem
keepalive 10 120
cipher BF-CBC
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 3
management localhost 7505

client.conf:

client
dev tun
proto tcp
ifconfig 10.8.0.2 10.8.0.1
remote 1.1.1.1 667
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert "cc.crt"
key "cc.key"
comp-lzo
verb 3
mute 20