Multi isolated subnet on single installation

JamesW

Hi all,

First time posting, so apologies if i missed something as have been trying to work out how to tackle this project and now hoping someone can point me in a direction that can lead me to my answers. I have skimmed through how-to sections, and have not found anything that specifically describes what i am trying to do.

What I am hoping to do is use my dedicated server as an OpenVPN server that my clients systems can use to retain a single LAN per site no matter their location (offsite pc's should be able to connect to on-site pc's) for a single application.

Using a single OpenVPN server install, can i divide the clients connecting into their own, isolated lan subnets according to their business? (They will be separate businesses so absolutely cannot be able to see/connect to other sites pc's).

I have made a diagram which should show quite clearly what i would like to achieve.
https://creately.com/diagram/ivcc4x3o/AbwSoTNVIM2rcVvlAaslOL11oMg%3D
The "Headquarter Base" in the diagram would be my workshop, which, if it is achievable, would have full access to every VPN subnet as I support the application they are using and can connect and make changes from my own workshop then without the need to remote to their terminals.

Basic run-down:

Dedicated server in data-center runs OpenVPN server. Only a single (public)IP address allocation.
Hyper-V will run on the server with client pc's running a head office system which needs access though to their own business systems on the VPN network.
Each business will have at least either one site(multiple pc's) + Hyper-V with head office, or multiple sites(multiple pc's each) which are connected via VPN.
All client pc's will use ca certificates for authentication to the VPN server, plus will be statically assigned ip's in the setup.

I have found how to do the static assigning and have done simple site to site testing without issues, but not sure where/how to go about creating isolated subnets from the server (or if it can even be done). I do not want to run multiple instances of OpenVPN if i can help it.

Can anyone give pointers or point me to a specific configuration example of this?

JamesW

ok, so after doing test setups, i have basically got it all working in the following way:

IPs below are not actual, just for demonstration purpose.
VPN Server 10.0.0.1 255.255.0.0

Business 1 (Workshop, needs access to all subnets of 10.0....)
IP 10.0.0.10-254 255.255.0.0 (allowing the VPN server to have 10.0.0.1-9 if needed)

Business 2
IP 10.0.1.1-254 255.255.255.0

Business 3
IP 10.0.2.1-254 255.255.255.0

This is fine in allocation of IP's.

But, I need Business 2 and 3 (and other future added) to NOT be able to access IPs outside of their own subnet (10.0.1.1-254)...

Where do I set the IP range access, would I do it via a ccd folder on the server and assigning individual client settings?

TinCanTech

You have three options that I know of:

Pushed routes; Clients have access to what ever routes you push them.
CCD would offer most fine grained setup.
Theoretically, could be tampered with by a knowledgeable client.
Openvpn built in packet filter; Clients have access to what ever you configure.
See: http://backreference.org/2010/06/18/openvpns-built-in-packet-filter/
Only supports IPv4 at this time.
Server firewall (iptables*); Clients have access to what ever you configure.
Do not use --client-to-client in server config.
* Could include policy based routing.

JamesW

Thanks for giving me something to research on TinCan.

I have not been able to find a solution yet though... The only way I have been able to enforce restricted access is through firewall policies on the client machines, which isn't going to be the most effective as if the clients turn off the firewall or get nosy, can re-enable access themselves quite easily. Plus some clients will be needing the VPN on personal laptops etc which I will have no control over any firewall settings.
If the server could enforce firewall settings that would work, I would be prepared to use that solution, but I was unable to successfully achieve what I could on the clients, onto the server. (I am using Windows Server 2012, so iptables is not an option)
I am hoping I am just missing something and this can be easily done, I cannot believe that this type of setup has not been accounted for in the numerous settings available within the VPN...

My research on your points came to the following conclusions:

Pushed routes. I thought this would have been the most logical way to set this up, but in my findings using pushed routes will only allow other internal networks on the server-side to be reachable by the clients. (Not what I am actually trying to do, I want to deny) Maybe if I set up separate daemons for each subnet/customer, then I may be able to use --iroute to route each particular subnet to the server subnet and not any others, but this firstly seems a huge waste of resources (running a server for customers that will only have 3-4 systems on the VPN seems illogical), and means with my current 35-40 customers would be a lot of separate instances to achieve a basic allow/deny setup... I will be using pushed routes when allowing access to the several hyper-v vm's that some customers will have.

Built-In Packet Filter. The guide in the link looked to be appropriate for Linux, not Windows, and also was for bridged setups and not tunneled. Using undocumented features is something of a concern if they become deprecated in the future as i am back to square one and with a whole lot of clients to quickly make changes to.

Server Firewall. As above, iptables is not going to work in a Windows server environment and I have not been able to find a Windows equivalent or have Windows Firewall accomplish the same...

If I am mistaken in any of my findings, please go ahead and correct me, and if possible, link me to somewhere that will explain why...