VPN Config CCD

jagrok

Dear All

I have a OpenVPN server, my server is able to connect client-to-client.

I`m using ccd to give some IP`s to my client

port 1194
proto udp
dev tun
ca ./keys/ca.crt
cert ./keys/hub.crt
key ./keys/hub.key  # This file should be kept secret
dh ./keys/dh1024.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

push "route 10.9.0.0 255.255.255.0"
push "route 10.10.0.0 255.255.255.0"
push "route 10.11.0.0 255.255.255.0"
push "route 10.12.0.0 255.255.255.0"
push "route 10.13.0.0 255.255.255.0"
push "route 10.14.0.0 255.255.255.0"
push "route 10.15.0.0 255.255.255.0"
push "route 10.16.0.0 255.255.255.0"
push "route 10.17.0.0 255.255.255.0"
push "route 10.20.0.0 255.255.255.0"

route 10.9.0.0 255.255.255.252
route 10.10.0.0 255.255.255.252
route 10.11.0.0 255.255.255.252
route 10.12.0.0 255.255.255.252
route 10.13.0.0 255.255.255.252
route 10.14.0.0 255.255.255.252
route 10.15.0.0 255.255.255.252
route 10.16.0.0 255.255.255.252
route 10.17.0.0 255.255.255.252
route 10.20.0.0 255.255.255.252

client-to-client
client-config-dir ccd

keepalive 10 120

comp-lzo
max-clients 20
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 3
mute 20
management localhost 7505

I want to modify this config to allow communication between selected users.

How to do it ? What i must move or put to the ccd ?
If i want to allow user A wich getting IP 10.9.0.1 to communicate only to user B 10.20.0.0
But user B can only communicate with a server ?

jagrok

Hello

I was created as you show me linked HOW TO, but i cannot access to any devices in my network.

server.conf

port 1194
proto udp
dev tun0
ca ./keys/ca.crt
cert ./keys/hub.crt
key ./keys/hub.key  # This file should be kept secret
dh ./keys/dh1024.pem

server 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
route 10.8.2.0 255.255.255.0
route 10.8.3.0 255.255.255.0
route 10.9.0.0 255.255.255.0
route 10.10.0.0 255.255.255.0
route 10.11.0.0 255.255.255.0
route 10.111.1.0 255.255.255.0

client-config-dir ccd
keepalive 10 120
comp-lzo
max-clients 20
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 3
mute 20
management localhost 7505

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:120 (120.0 B)  TX bytes:120 (120.0 B)

Here are rules to give an Access for specific sers

Administrator rules

iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.8.1.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.8.2.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.9.0.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.10.1.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.11.1.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.111.1.0/24 -j ACCEPT

Employees rules

iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 10.11.1.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 10.111.1.0/24 -j ACCEPT

Contractor rules

iptables -A FORWARD -i tun0 -s 10.8.2.0/24 -d 10.111.1.0/24 -j ACCEPT

Here are iptables which was runned for test access from admin to some client

# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -s 10.8.0.0/24 -d 10.111.1.0/24 -i tun0 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -d 10.11.1.0/24 -i tun0 -j ACCEPT

Any idea how to fix it ?
sysctl have a set up ipv4 forwarding for 1

jagrok

Hello again.

Becouse i had a time, i was try to use this configuration again.
I`m a little confused becouse some time it`s working for me, sometimes not.
I also was trying adding to server.conf line topology subnet, but it also doesnt help me with my isue.
Who will be good man and will try to help me to fix it ? 🙂

jagrok

Any idea how to fix it ? 🙂

I have a headache when i was looking for iptables 🙂