mevans336
We currently use OpenVPN on pfSense and run multiple servers. We allow access to different areas of our network based on which VPN they connect to via firewall rules.
We've deployed OpenVPN AS using the Hyper-V image and it works great. However, the only method I can come up with for isolating users is to manually create iptables rules which is fine, but an iptables --list results in pages and pages of output, which is daunting to say the least.
Our plan is to have two OpenVPN AS servers, one which allows full access and another which only allows whitelisted traffic.
For the server that only allows whitelisted traffic, which rulesets should I modify? I see the following:
INPUT, FORWARD, OUTPUT, AS0_ACCEPT, AS0_DNS, AS0_IN, AS0_IN_NAT, AS0_IN_POST, AS0_IN_PRE, AS0_IN_ROUTE, AS0_OUT, AS0_OUT_LOCAL.
I'd like to allow a user to connect to the server, but be denied access to everything. Then I'd like to add individual rules to allow, for example, SSH access to a specific IP on a specific port. I can figure out the iptables rules, but I'm not sure which chain to create the deny all and then the individual allow rules in.
This is the last hurdle before we purchase licenses.
