I've read the section that talks about creating a ccd and gives the admin 1 IP range and other clients that get single server access anther IP range. As I'm new to this openvpn stuff I was hoping that someone could check my thought process.
My servers are in the 192.168.1.0/24 range on my local network. OpenVPN gives my clients 172.16.8.0/24. I want to force certain clients to only have access to 192.168.1.162. Below is my current setup which works great to access all of my local network.
openvpn.conf
port 10021
proto udp
dev tun
ca ca.crt
cert openvpn-server.crt #Server public key
key openvpn-server.key #Server private key
dh dh.pem #Diffie-Hellman parameters
server 172.16.8.0 255.255.255.0 #Purple network
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0" #Yellow network
tls-auth ta.key 0
#crl-verify crl.pem
keepalive 10 120
cipher AES-256-CBC
group nobody
user nobody
comp-lzo
persist-key
persist-tun
verb 3
ipfw.rules
#!/bin/sh
EPAIR=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep epair)
ipfw -q -f flush
ipfw -q nat 1 config if ${EPAIR}
ipfw -q add nat 1 all from 172.16.8.0/24 to any out via ${EPAIR}
ipfw -q add nat 1 all from any to any in via ${EPAIR}
TUN=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep tun)
ifconfig ${TUN} name tun0
New Setup
route 192.168.2.0 255.255.255.0 # add to openvpn.conf for single server user
client-config-dir ccd # to create ccd directory in /etc/openvpn
ccd/client1 #create file to add entries for new client in ccd
ifconfig-push 192.168.2.1 192.168.2.2 #place in ccd/client1 file
iptables -A FORWARD -i tun0 -s 192.168.1.0/24 -d 192.168.1.162 -j ACCEPT #edit /usr/sbin/iptables with this
Sorry if this is basic stuff any help would be appreciate. Thanks
