I have the following scenario:
Ubuntu 14.04 LAN IP:192.168.0.100
Hosting OpenVPN with range: 10.0.0.0/16
I installed OpenVPN on Ubuntu 14.04 and successfully configured it to work.
I'm not using any certificates, I'm authenticating clients via username/password only.
The clients are devices that I want to be able to reach from the server only. They must not be able to reach each other, only the server.
After creating the basic config, the default behavior works as required, the devices connected are only reachable from the server, and they are hidden from each other.
Question 1:
Is the config safe as it is? Do I need to be explicit about any parts in the configuration concerning the client's visibility of each other?
Question 2:
Given that the clients won't be connecting to each other, am I safe from a MITM attack even though I'm not using any certificates?
Question 3, most importantly:
I would like to add another Ubuntu machine in the same LAN with IP 192.168.0.120
How can I configure it to be able to reach the clients on the server hosting OpenVPN (192.168.0.100) without being a client to OpenVPN? Is this doable via firewall settings?
Any pointers would be very much appreciated, thanks
Here's my current server config in case it is required
proto tcp
port 1194
dev tun
# 10.0.0.0/16
server 10.0.0.0 255.255.0.0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/ZimaVpn-1.crt
key /etc/openvpn/keys/ZimaVpn-1.key
dh /etc/openvpn/keys/dh2048.pem
persist-tun
keepalive 10 120
topology subnet
user nobody
group nogroup
#daemon
#
#status /home/ovpn/openvpn.status
verb 3
#log-append /var/log/openvpn.log
client-cert-not-required
username-as-common-name
# required for scripts to work
script-security 2
client-connect /etc/openvpn/scripts/connect.sh
client-disconnect /etc/openvpn/scripts/disconnect.sh
auth-user-pass-verify /etc/openvpn/scripts/auth.sh via-file
