2 instances of openvpn with different ip's on a vps server problem

gabberhead

hello,

i realy need some help. the whole day iam trying to fix it, but i cant finished it.
i have a vps server with openvpn. the openvpn server has two configs for differnt ips. it is running. this is not the problem. both server configs are working without problem. the problem is which i can not fix it is following:

i would like to have two different ips for differnt users. one server config for normal users (192.168.243.0) and one server config for me as an admin (192.168.244.0). like i said. it is working, but how can i set iptables to lock the normal users in their ip range only and me as an admin with multiple devices to get access all users on both ip ranges.

this is my config:
server config1:
port 12345
proto tcp-server
dev tun0
tls-auth ta.key 0
topology subnet
server 192.168.243.0 255.255.255.0
push "route 192.168.244.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-config-dir /home/test/ccd
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
group openvpn
keepalive 10 60
cipher AES-256-CBC
tls-cipher AES256-SHA
auth SHA256
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3
mute 15

server config 2:
port 12346
proto tcp-server
dev tun1
tls-auth ta.key 0
topology subnet
server 192.168.244.0 255.255.255.0
push "route 192.168.243.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-config-dir /home/test/ccd
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
group openvpn
keepalive 10 60
cipher AES-256-CBC
tls-cipher AES256-SHA
auth SHA256
persist-key
persist-tun
status openvpn-status1.log
log openvpn1.log
verb 3
mute 15

ccd for user on server1:
ifconfig-push 192.168.243.174 255.255.255.0

ccd for user on server2:
ifconfig-push 192.168.244.2 255.255.255.0

iptables (its not complete i hae only which are working in it)

# Generated by iptables-save v1.4.14 on Fri Feb 10 13:53:11 2017
*filter
:INPUT DROP [2:479]
:FORWARD ACCEPT [19:1350]
:OUTPUT ACCEPT [90162:8930331]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11789 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11810:11815 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 13543:13545 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 33111:33124 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Feb 10 13:53:11 2017
# Generated by iptables-save v1.4.14 on Fri Feb 10 13:53:11 2017
*nat
:PREROUTING ACCEPT [7:837]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [5:314]
:POSTROUTING ACCEPT [5:314]
-A POSTROUTING -s 192.168.244.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Feb 10 13:53:11 2017

and the users in 192.168.243.0 is there a way to set iptables that the users dont see each other?

in short: lock users in this ip range 192.168.243.0 wihout seeing each other only to have conntact to the server. and the other ip range me as admin 192.168.244.0 to have full access in 192.168.243.0 and 192.168.244.0 and that i can see all users and can login into the devices if nessesary.
if u need something i can post it. thanx in advance. i hope to get fix it soon ;)

TinCanTech

gabberhead wrotei have a vps server with openvpn

gabberhead wrote-A POSTROUTING -s 192.168.244.0/24 -o eth0 -j MASQUERADE

As the server is a VPS you may need to use a different iptables rule:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 12.34.56.78

Change these values accordingly:

-s 10.8.0.0/24 -- change to your VPN subnet
--to-source 12.34.56.78 -- change to your outgoing IP

gabberhead

Thanks. But I think this is not what I am looking for. I need the users which have 192.168.243.0/24 to be locked in this subnet only and without seeing it each other and the users with 192.168.244.0/24 to can connected to users in the 192.168.243.0/24 and 192.168.244.0/24 subnet.

gabberhead

i am now a little bit further. i have also this now in my iptables:

-A FORWARD -s 192.168.243.0/24 -d 192.168.243.0/24 -j DROP
-A FORWARD -s 192.168.243.0/24 -d 192.168.244.0/24 -j DROP
-A FORWARD -s 192.168.244.0/24 -d 192.168.244.0/24 -j ACCEPT
-A FORWARD -s 192.168.244.0/24 -d 192.168.243.0/24 -j ACCEPT

with this config it works but only one thing not.

-A FORWARD -s 192.168.243.0/24 -d 192.168.243.0/24 -j DROP
this works. users can not connect to each other

-A FORWARD -s 192.168.243.0/24 -d 192.168.244.0/24 -j DROP
this works. users can not connect to the .244 subnet

-A FORWARD -s 192.168.244.0/24 -d 192.168.244.0/24 -j ACCEPT
this works. users can connect to to each other

-A FORWARD -s 192.168.244.0/24 -d 192.168.243.0/24 -j ACCEPT
this is not working. .244 users can not connect to .243 users. this is now the last thing to fix. am i something missing in the iptables now?