multi-client VPN with unique routes per client

tseelbach

I'm using OpenVPN to provide vpn for multiple clients connecting through an OpenVPN server, currently using a shared certificate and a single set of static routes are pushed. I see how OpenVPN can be configured to authenticate unique users, but how can I configure OpenVPN such that each client has unique routes pushed to them? Ideally the routes would not be statically configured but rather would be provided to the OpenVPN server after client authentication.
Thanks,
Tom

mwandelaar

Hi Tom,

First, issue every unique client it's own, distinguished, certificate.
Then you can use the "client-config-dir" directive to push specific items to a specifice client, based on the CommonName (CN) of the certificate:

server 10.0.8.0 255.255.255.0
topology subnet
client-config-dir /etc/openvpn/ccd

And then, for user1, with CN=user1, create a file:

/etc/openvpn/ccd/user1

with the content:

# If you want a fixed adress, take care of the rest of your config
#ifconfig-push 10.0.8.12 255.255.255.0
#push route-gateway 10.0.8.1
push "route 192.168.10.0 255.255.255.0"

In this case you are pushing 1 specific route (192.168.10.0/24) to your client.

tseelbach

Thanks mwandelaar,
We will give this a try. Also I bought "Mastering OpenVPN" and found the section on client-config-dir. Client specific Config - pg 122.

- Tom