anthonysomerset
Hi there
we deployed openvpn community initially and were able to get this to work with some SNAT rules in iptables but we are in the process of upgrading to access server for its better AD integration and far better management interface.
what we would like to do is this:
we push all of our VPN routes to all users
we assign users to specific groups that get a specific subnet/ip range for a VPN IP
eg default 10.40.0.0/24
technicalgroup 10.40.1.0/24
what we want to do is leave the default NAT rules in place which basically NAT's to the servers public IP as this works
but we would like to SNAT the technical group subnet to a secondary public IP of the server.
this is so that we can have tighter ACL's and only allow a few devices to be accessed via the default subnet/nat and all devices to be allowed for the technicalgroup subnet/nat
you could ask why dont we only push the specific routes needed by default, however some/many of our devices that we only want technical to see are also in same subnets of devices that we do want default VPN to access so theres a significant management overhead to this whereby setting the ACL on the end device and pushing all routes allows us to more easily manage this on device by device basis.
what makes sense to me as a way of a solution and i manually tested this works:
inject a custom NAT rule into iptables in the right place that performs the extra source nat routing. what I'd like to have though is custom NAT by subnet within the interface or a way of injecting said iptables rules in a safe way that wont leave them prone to being broken in future
