Prevent the client routing table modification during OpenVPN connection

hiton

Hello,
I set up an OpenVPN server for my company for a remote access to many internals networks.
I have configured 3 instances on the OpenVPN server because we have 3 differents types of access which corresponding to 3 differents population types with differents access rights.

The OpenVPN server is not the client default gateway because only the trafic to the internals networks of my company pass through the OpenVPN server. The Internet trafic pass through the client default gateway (Internet access provider).
So the OpenVPN server push the internals networks statics routes in the client routing table but the pushed routes are differents for the 3 openvpn instances because the access rights are differents.
It permits to have a first security just using the routing.

But the client can still modify his routing table and add route manually for the others internals networks which are not pushed for his openvpn instance.

Is there a function in openvpn which permit to disconnect a client if his routing table is modified during the VPN connection ?
Or is there a way/a function in openvpn which prevent/forbid the client to modify manually his routing table ? (add/delete route, etc...)

Thank you in advance for your help.

TinCanTech

hiton wrote Is there a function in openvpn which permit to disconnect a client if his routing table is modified during the VPN connection ?

No.

hiton wrote Or is there a way/a function in openvpn which prevent/forbid the client to modify manually his routing table ?

No.

The standard method would be to configure iptables rules to allow your preferred access.
https://openvpn.net/index.php/open-source/documentation/howto.html#policy

hiton

Ok thank you !
I think it could be an interesting functionality for the next openvpn's versions 🙂
Indeed i have no choice, i will configure iptables rules to allow each access.