wiscnukegrad693
Note: I have not yet used OpenVPN and know very little. I would like to know more before I invest in hardware.
I am going to set up a home/business VPN and I need to know what if what I want to do is possible.
I am planning to host this on a Netgear Nighthawk R7000 router or similar.
I would like to know if I can have different user/password combinations that each have access to different parts of my network. For example, I will have business people who log on and I would like to give them access to the business machines, but not my home network file server and home computers. But I would like to be able to log on with a different U/P and access the entire network, regardless of the machine that I log on from (so limit by user/password combination rather than source IP or machine name/domain, etc). I would prefer to do this all with a single router.
Is this standard operation of OpenVPN? Is it relatively easy to set up?
Sorry is a really simple question, but it is hard (for me) to find the answers to simple questions on OpenVPN for some reason.
Thanks!
terrorfrog
Yes and no,
Look its a vpn so access management is reduced to communication.
so what you can do - the hard way
configure it so the default is part of your network where everyone has access
use CCD (client config dir) and assing each user a fixed ip
assign routes for special parts of your network accordingly to your special users (that part can be skipped but why not)
use a filewall to block access to certain parts of your network
the easy way
make multiple instances on different port
use different routes and connectivity
use firewall to block the hole subnet for non authorized users to your special parts of the network
however be aware you always need to firewall those clients you dont wan in other parts of your network
simply hiding the route will usually do the trick but if someone really want to get in he can
however you cant really do that on a home router, use a linux instance (can be a virtual machine on a server)
also a vpn is a secure aerea, but you still use auth on your machines on userlevel, so if you dont expect your choosen vpn client to be hackers i dotn see a real reason why trying to block em on vpn level when you have setup a moderate security on windows/server level
ofc you do that on high security networks. ther you want to isolote different groups of clients, and different parts, even single servers want to be isolated form each other.
another additonal way is to islate with virtual lan, where one instance of openvpn simply routes on a vlan interface where your switches only allow access to that part of your network
aynway, given you want todo this on a netgear give me doubt you own a vlan switch or the importance of client isolation at all 🙂)
and no this is not common openvpn or any vpn overation in that sense.
common authentication yes it is, but understand network layer isnt a security layer for your applications/servers, but can add security ofc
terrorfrog
PS if you want something real 2 way
best way - a server running a virtual instance of openvpn with a linux firewall - managed by firewallbuilder very powerful
OR a virtual instance with running pfsense opensource edt. which makes management for you insanly easier
secodnway allinone with router solution run a pfsense box - preferably (first few support incidence included) a pfsense box
pfsense run openvpn, and has a nice webinterface to manage its firewall abilities and a lot of extras bells and whistles
opensource version is free, their boyes are nice, little more expensive then own build but with free support incidents (i think 3)
wiscnukegrad693
Thanks, I will look into your recommendations. Luckily I updated my router firmware and it now supports openvpn, so I can experiment with it now without spending money.
RebeccaLane
It is necessary to set all up so that would be when connecting users were divided into groups with different access rights to the network (for example, certain services or network segments). I think this is possible with the script, but I have not a chance to test it :cry: You need to learn more about the Nighthawk R7000 router and similar models to choose the most long ranged router for your network type
