I currently have a OpenVPN server running on my Windows server and it's been perfect for me when I'm out of the house to access my entire network.
My ISP/Cable company has a mobile app that allows you to watch anything I could on my TV, but only if I'm on the second network. With OpenVPN, this works perfectly. I've given my family members certificates so they can now VPN and use the app to watch local sports. They are 😃 But they also have access to all of my network, but I've no problem with that since I trust them.
Now I want to create a certificate that I can give out to a friend, but I don't want them to have access to anything on my network. All they should get is internet access. What is the best way of accomplishing this? Should I create a second server, or can I modify my existing server configuration?
Here is what my client certificate looks like (NB, I embed my the certs to make it easier for them to install on iOS and Android devices):
client
dev tun
proto tcp
remote mydnsname.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
<ca>
-----BEGIN CERTIFICATE-----
snip
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
snip
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
snip
-----END PRIVATE KEY-----
</key>
and here is my
server.ovpn file:
port 1194
proto tcp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.68.1"
client-to-client
duplicate-cn
ifconfig-pool-persist ipp.txt
status openvpn-status.log
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 10
persist-key
persist-tun
log openvpn.log
verb 3
