dvsJ
I'm trying to isolate access on a per client basis, allowing a 1:1 tunnel basically.
I'm using Routed VPN with a static IP pool of 10.10.0.0/16
My internal network is using 10.0.0.0/16
I am trying to link private servers to VPN clients with a matching IP pattern, so 10.0.1.1<->10.10.1.1
I need to restrict access from other hosts/clients however, so I'm looking to use the access control rules to set specific to/from rules. Unfortunately, the only way I seem to be able to initiate a connect from the server side is when I use the Web UI's Advanced VPN | Private Routed Subnet list, which opens the whole range of servers to any client.
I am wondering if I can drop in a user specific access_from "-Route:10.0.0.0/16" and "+Route:10.0.1.1/32", but I don't know which rule is processed first. Is there another way to do this that I am missing?
I've tried leaving the PRS table empty and explicitly allowing access_from without the denial route, but I get no action.
I'm open to suggestions, thanks.
