pslav
Hi,
i have a VPN in tun mode and my clients act as vpn gateway and forward traffic of some of their clients to a server.
In general i use ccd-exclusive and i have an iroute setting in the respective client config file.
Behind my VPN gateways (clients) are several machines, however, only one of them is allowed to use the gateway (and there are some IP conflicts, so there might be 2 clients with the same ip address behind different gateways, where one has the permission, while the other one does not have the permission).
Since i make use of iroute with exactly one IP, and the IPs are chosen accordingly, i do not have any routing problems.
However, i'm afraid that when e.g. my firewall crashes on the gateway side, an illegal client (with a legal ip) manages to reach the server-side network. Of course all kinds of response won't reach this device at all, cause the routes would be wrong (and the permitted device would receive the response), but i guess that requests would reach their destination...
To get to the point: does iroute X.X.X.X ensures for a certain client that only packets from this IP are accepted as well? So actually i simply want to employ some kind of filtering that for one user allows only traffic originated by the machine with the IP stated by iroute in the ccd file of the user.
so if a malicious box sends a request through a tunnel where this IP is not listed 'somewhere', the packet gets already dropped by OpenVPN - cause the problem is that once the packet has been dispatched by OpenVPN, my firewall cannot distinguish the actual originator...
In some blog posts I found that OpenVPN supports some kind of filtering, but the documentation is rather limited and it seems that this is only to restrict client-to-client comunication, which is disabled entirely in my setting.
best regards,
pslav
