bbowman
I have successfully set up OpenVPN to authenticate AD users using my existing RADIUS server. In NPS I created a policy that allowed members of a specific security group to connect through OpenVPN. In this policy I want to restrict VPN access to a single IP address in my internal network. When I test this I am able to connect to OpenVPN but access is not restricted and the user has access to my entire internal LAN. I'm fairly certain that the NPS policy is correct because when I connect via my existing RRAS PPTP VPN connection through this policy the user restriction works and that user an only access that specific IP address when they connect to the PPTP VPN.
Anyone have a suggestion on what to look for to make sure the restricted policy works correctly?
bbowman
revisiting this issue again. Anyone have any ideas as to how I can restrict and limit access to my internal network using NPS with OpenVPN?
bbowman
In case anyone also has this problem, I was able to solve it with the assistance from OpenVPN support. The access permissions is not done via NPS, it is done via the Access Server.
Go to VPN Settings->Routing and clicked No under ‘Should VPN clients have access to private subnets’. Previously this was enabled and all of our internal subnets were listed there. I then created Group A and granted access to all internal subnets and added User1 to this group. User1 connected and was able to access resources in all subnets. I then created Group B and granted access to a single IP address in one of the subnets and added User2 to this group. User2 connected and was only able to access that specific node.
