"star" topologie

yigal_dorix

Hi,
I'm trying to setup a star topology on a VPN, and I'm starting to thing it's impossible...
I want to set up a network of POS. Each branch will have 3-10 POS. In the end, I will have 100s of branches. I cannot allow POS from different branches to see each other. It is fine that none of the POSs will be able to communicate with each other. But... I need a couple of administrators to be able to see each and every POS.
I thought I could omit the client-to-client configuration from the server and configure it in the admin clients but I didn't find a way to do this.

I think what I need to do is set up a different VPN for each branch (using the same server, with seperate ca.crt*pem*server.crt*server.key file. Am I right or is there a better way to solve this?
If this is the way, do I separate the VPNs by server port address or IP?

Thanks.

maikcat

you CAN allow client-to-client traffic without client-to-client directive.

*make sure ip_forwarding is enabled
*add an iptables rules similar to

iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT

To allow only a single client IP, use something like

iptables -I FORWARD -i tun+ -s 10.8.0.26/32 -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT

also you can read this:

http://backreference.org/2010/05/02/controlling-client-to-client-connections-in-openvpn/

Michael.

Traffic

Cheers Michael: Nice link. :ugeek: