Topology subnet with server to client only access?

lucianousesinf

It's possible to make that?
I have one OpenVPN server at Windows 2008 that I have many clients connected. Working fine with subnet topology, but this makes the clients "see" each other. I want to block that, I want the server only access clients and no client to client connection.

Thanks.

lucianousesinf

Ok :oops:

But are no client-to-client in config.

The server config are:

port 1194
proto udp
dev tun
dev-node OpenVPN_interna
ca ca.crt
cert srv_sigcloud_interno.crt
key srv_sigcloud_interno.key
dh dh1024.pem
server 172.16.10.0 255.255.255.0
topology subnet
ifconfig-pool-persist ipp.txt
comp-lzo
persist-key
persist-tun
keepalive 10 120
status SigCloud_OpenVPN.log
verb 3

lucianousesinf

The server configs are above, the client are below.
The goal, block client to see each other. For example if I ping 172.16.10.6 in client 172.16.10.5 goes fine, shouldn't do.
Are no problens to connect client <-> server.
And no, it's UDP not TCP.
And no, it's tun not tap.

client
dev tun
dev-node MyTap
proto udp
remote xxxxxxxxxxxxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
pkcs12 arquivo.p12
ns-cert-type server
comp-lzo
verb 3

Reading comments at config file, I saw that "client-to-client" config was needed to do the inverse behavior that I wanted. And there says "To force clients to only see the server, you will also need to appropriately firewall the server's TUN/TAP interface." This means that I need, obligatorily, configure the windows firewall to block the clients?
Also has a comment saying "By default, clients to only see the server", this's not happening.