Greetings,
This is more of a conceptual question, but for anyone who's actually implemented this, specifics are welcome.
I'm trying to setup a VPN server for a group of friends and I as we work on a project. I will implement something like this Github project:
https://github.com/gdestuynder/openvpn-netfilter. This will enable the VPN server to lookup ACLs for a user, and implement them using iptables on the server side. All other traffic would be dropped.
For my own personal home VPN, I know I can use the following in my client.ovpn config to not route Internet traffic through the VPN:
route-nopull
route 192.168.1.0 255.255.255.0
Where 192.168.1.0/24 is my home subnet, and 10.8.0.0/24 (not shown) is the DHCP IP range of the tun adapter. I know placing that in the client's configuration overrides the server setting
push "redirect-gateway def1 bypass-dhcp"
.
This is where I get confused: I already know my home subnet is 192.168.1.0/24, so I can easily place that in the client.ovpn file. But if I have no knowledge of the subnets/IPs I have access to (as most users don't), how does OpenVPN dynamically push per user VPN rules to the client?
In other words, if user1 has acess to 10.0.0.2 and 10.0.2.10 and user2 has access to 10.0.2.10 and 10.0.3.4, how does OpenVPN know to push the right routes to each user, while using the same generic client.ovpn configuration, while ALSO using the users ISP for regular internet traffic?
