Using IPTables to block access between clients

sofuca

Hello, I'm running openvpn on centos 7

OpenVPN 2.3.10 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 4 2016

It is configured at TAP so I'm getting a lot of traffic between the clients I have connected. This is a problem.

What I want to do is allow only a few clients (say 10.0.1.102 and 10.0.1.103) to access the client 10.0.1.104.

Is this possible? It needs to be done with IPTables on the OPenVPN server it's self, not on the clients.

Going forwards I'll be configuring a new server with TUN so won't have this problem but for the moment I'm stuck with a legacy install.

Thanks!

TinCanTech

I believe you need to use ebtables not iptables.

However, I would focus on reconfiguring to tun and not waste time on tap.

dazo

iptables may very well be the right choice. ebtables is more important if bridging is involved.

But your issue is pretty much the nature of TAP. TAP interfaces acts more like normal Ethernet based network interfaces. So all broadcast traffic will be passed over the VPN, as well as client-to-client traffic. The FORWARD chain in iptables can be used to restrict this behaviour.

For more information on TAP and TUN, see this wiki post: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting