OpenVPN server for only WAN access

RobV

Hi there,

I installed OpenVPN on a Raspberry pi and the VPN connection works.
I only have one wish, and I can't get this happen.

I want to control the server, that the vpn clients can't connect to the local LAN.
So email, web, etc is allowed, but no LAN access.

The current rc.local is set like:
iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.2.91

I think I have to change something here, but it didn't succeed so far.

Can somebody help me?

Traffic

Please see the Forum rules (top of page)

RobV

Attached my openvpn.conf

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
client-to-client
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
log-append /var/log/openvpn
comp-lzo

Hope this is sufficient.

Traffic

RobV wroteHope this is sufficient

25% of sufficient ..

Your clients do not have access to your server LAN.

RobV

Traffic wrote
RobV wroteHope this is sufficient
25% of sufficient ..

Your clients do not have access to your server LAN.

Yes they do.
When I connect to the VPN myself, I can connect to local server(s)

Traffic

From your client you cannot ping your server's LAN IP, you can only ping it's VPN IP.

RobV

Traffic wroteFrom your client you cannot ping your server's LAN IP, you can only ping it's VPN IP.

No, why do you think that.
When I make a VPN connection(from other location), I can ping all my servers, I can connect to them.
I think in rc.local I need to disable that.

Traffic

RobV wrotewhy do you think that

Because of the information asked for you posted 25% ..

Traffic

You will need to use iptables to block access to your server LAN.

RobV

Traffic wroteYou will need to use iptables to block access to your server LAN.

I also think so.
But what do I need to include in iptables?