Override 'Default' Server Routes - Push Specific Routes

Simple_One

Hi All,

I'm supporting an OpenVPN server for a business and it is suffering from scope creep. Originally the server was setup to provide remote access to everything on the LAN (10.1.0.0/16) for all users but now there is a lot of noise about limiting the routes that are pushed to specific users.

Unfortunately, the server is managed remotely and the users are really physically remote and I have no direct access to their devices (making it very hard to make changes to client.ovpn).

Is there a method that can be implemented from the server side alone (probably using client specific overrides) that effectively says the following?

" Please don't take the 'base/initial' routes pushed from the server (ala, route-nopull in the client config), but once those routes have been happily ignored, do please accept these tastier client specific override routes instead"....?

Traffic

Just don't push the routes in the first place .. :roll:

Simple_One

Yeah, the bummer there is that it means I need to setup specific overrides for the majority of the users rather than the relatively fewer users that need reduced access.

But I'm hearing you, its the logical approach, I was just hoping for a 'lazy IT' solution 😉

Traffic

Simple_One wroteI was just hoping for a 'lazy IT' solution

do it right the first time by understanding what you are dealing with .. :mrgreen: