Hi there, I successfully configured and running my openvpn server on ubuntu 14.04 (x64 serv.ed). It mostly configured like this: dev tun auth-user-pass-verify ... via-file client-cert-not-required client-config-dir ccd username-as-common-name ccd-exclusive ... I was wondering if there is a method to filter connections/traffic from a specific username surfing from a specific public IP... The goal is: [b]I want that user X could only login with a specific public IP[/b] I could also accept the idea that he can login with any public IP but its traffic to the LAN is forwarded only if he's surfing from a specific public IP... For that I thought I should with work with iptables and with the traffic between eth0 and tun0... could you please help me to figure this out? Thanks.

[quote="peppezic"] I thought I should with work with iptables and with the traffic between eth0 and tun0[/quote]when the client connects/disconnects: [list][*]Use [b]--client-connect script[/b] to modify your iptables to the specific rules you need. [*]Use [b]--client-disconnect script[/b] to reset iptables.[/list]

[quote="Traffic"][quote="peppezic"] I thought I should with work with iptables and with the traffic between eth0 and tun0[/quote]when the client connects/disconnects: [list][*]Use [b]--client-connect script[/b] to modify your iptables to the specific rules you need. [*]Use [b]--client-disconnect script[/b] to reset iptables.[/list][/quote] Ok...but how do I get client public IP?

From the environment variable [b]untrusted_ip[/b]

Allow/deny access by client public ip

peppezic

Hi there,
I successfully configured and running my openvpn server on ubuntu 14.04 (x64 serv.ed).
It mostly configured like this:
dev tun
auth-user-pass-verify ... via-file
client-cert-not-required
client-config-dir ccd
username-as-common-name
ccd-exclusive
...
I was wondering if there is a method to filter connections/traffic from a specific username surfing from a specific public IP...
The goal is: I want that user X could only login with a specific public IP
I could also accept the idea that he can login with any public IP but its traffic to the LAN is forwarded only if he's surfing from a specific public IP...

For that I thought I should with work with iptables and with the traffic between eth0 and tun0...

could you please help me to figure this out?

Thanks.

Traffic

peppezic wrote I thought I should with work with iptables and with the traffic between eth0 and tun0

when the client connects/disconnects:

Use --client-connect script to modify your iptables to the specific rules you need.
Use --client-disconnect script to reset iptables.

peppezic

Traffic wrote
peppezic wrote I thought I should with work with iptables and with the traffic between eth0 and tun0
when the client connects/disconnects:
Use --client-connect script to modify your iptables to the specific rules you need.

Use --client-disconnect script to reset iptables.

Ok...but how do I get client public IP?

Traffic

From the environment variable untrusted_ip