I have a setup that requires me to split clients into two separate subnets. The reason for this is that clients in subnet A should not be allowed to talk to eachother, nor to any client in subnet B. The clients in subnet B should however be allowed to initiate communication with the clients in subnet A. All of this is possible to configure using a firewall.
How do I dynamically assign the clients to a subnet? I'm using X.509 certificates, and it's possible to determine what subnet the clients belong in from their X.509 Common Name.
I tried the following script (--client-connect):
if [ ... ]
then
echo 'ifconfig-pool 10.0.0.1 10.0.255.254 255.255.0.0' > $1
else
echo 'ifconfig-pool 10.1.0.1 10.1.255.254 255.255.0.0' > $1
fi
but that wasn't a valid option (
Options error: option 'ifconfig-pool' cannot be used in this context (/tmp/openvpn_cc_04b6c13568c087df58c8ae929fd13a6f.tmp))
Is there a way to achieve this split using a single OpenVPN instance? Worst case scenario, I'll setup a parallell instance on another port, but that's not desirable.
