Access Control for groups not working

rokeeffe

Hi,

Following on from a successful two user test we have purchased a ten user license to grow the test a little more.

So I have now split out users into three groups based on their role in the company.

On the VPN Settings page I have listed the full list of subnets we need to get to in "Specify the private subnets to which all clients should be given access (as 'network/netmask_bits', one per line):"

I then narrow that down to individual subnets or IP's depending on the group in the group permissions page.

The issue is that everyone in any group with access controls set have access to every subnet.

If I try add only one subnet in the VPN Settings page and then add other subnets to the groups it does not work (people still have access only to the subnet listed in the VPN settings page). So it looks like access control for groups is not working. Or I am not working it correctly.

I've chased up the documentation and searched through the forums but there's nothing that specifically addresses this issue.

Just wondering has anyone got around this or got it working correctly?
Cheers,
Ronan.

OpenVPN AS version 2.0.12
Platform: RHEL 6.6
License: Ten user purchased

rokeeffe

Output from confdba -us -p

Is the +SUBNET anything to worry about when listing for specific IP's only?

[root@testbox scripts]# ./confdba -us -p group1
{
  "group1": {
    "access_to.0": "+SUBNET:172.xx.xx.12:tcp/80",
    "access_to.1": "+SUBNET:172.xx.xx.12:tcp/443",
    "access_to.2": "+SUBNET:172.xx.xx.14:tcp/80",
    "access_to.3": "+SUBNET:172.xx.xx.14:tcp/443",
    "c2s_dest_s": "false",
    "c2s_dest_v": "false",
    "group_declare": "true",
    "prop_autologin": "false",
    "prop_deny": "false",
    "prop_superuser": "false",
    "type": "group"
  }
}
[root@testbox scripts]# ./confdba -us -p group2
{
  "group2": {
    "access_to.0": "+SUBNET:192.xx.xx.26",
    "access_to.1": "+SUBNET:192.xx.xx.251",
    "access_to.2": "+SUBNET:10.xx.xx.0/24",
    "access_to.3": "+SUBNET:172.xx.xx.5",
    "c2s_dest_s": "false",
    "c2s_dest_v": "false",
    "group_declare": "true",
    "prop_autologin": "false",
    "prop_deny": "false",
    "prop_superuser": "false",
    "type": "group"
  }
}

Forgive the x's, paranoia.

rokeeffe

Ok,

Got it working with some help from Novaflash on the #openvpn-as irc channel.

Steps:
Under Routing in the VPN Setting page set Should VPN clients have access to private subnets (non-public networks on the server side)? to 'No'.

Add your groups and tick yes for Use Access Control?
Input your IPs, Subnets, ports etc.
Add your users to the Group(s) you have created.
Grant access here to a subset of the IP's, Subnets and ports of the Group they are in.