Hi.
We have a Linux server that is running on an internal network with a NAT'd public IP address.
We want to make the service running on that server available via it's public IP address, using a VPN.
We have installed OpenVPN and configured it using the following templates:
#Tunnel Options
compress lz4
dev tun
group nobody
keepalive 10 60
local {Private IP Address}
persist-key
persist-tun
port 1194
proto udp
script-security 2
topology net30
user nobody
verb 3
#Server Mode
auth-user-pass-verify "{External Authentication Script}" via-file
push "route {Private IP Address} 255.255.255.255"
server {VPN Network} {VPN Subnet Mask}
username-as-common-name
#Client Mode
#Data Channel Encryption Options
auth SHA512
cipher AES-256-CBC
#TLS Mode Options
ca /etc/pki/openvpn/ca.crt
cert /etc/pki/openvpn/server.crt
dh /etc/pki/openvpn/dh.pem
key /etc/pki/openvpn/server.key
remote-cert-tls client
reneg-sec 0
tls-auth /etc/pki/openvpn/ta.key
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
tls-version-min 1.2
#SSL Library information
#Generate a random key
#TUN/TAP persistent tunnel config mode
#Windows-Specific Options
#PKCS#11 Standalone Options
#IPv6 Related Options
#Tunnel Options
compress lz4
dev tun
nobind
persist-key
persist-tun
proto udp
verb 3
#Server Mode
#Client Mode
auth-user-pass
client
pull
#Data Channel Encryption Options
auth SHA512
cipher AES-256-CBC
#TLS Mode Options
<ca>
</ca>
<cert>
</cert>
<key>
</key>
remote {Host Name or Public IP Address} 1194
remote-cert-tls server
<tls-auth>
</tls-auth>
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
tls-client
tls-version-min 1.2
#SSL Library information
#Generate a random key
#TUN/TAP persistent tunnel config mode
#Windows-Specific Options
#PKCS#11 Standalone Options
#IPv6 Related Options
Let's say the following are used:
Private IP Address = 172.16.0.10
VPN Network = 10.16.0.0
VPN Subnet Mask = 255.255.255.0
On the host we have enabled:
net.ipv4.ip_forward = 1
to allow comms between the VPN network and the server's private IP address.
This all appears to work perfectly. The clients get assigned an IP address for the VPN plus a route to the server's private IP address, eg.:
Server Address:
inet 10.16.0.1 peer 10.16.0.2/32 scope global tun0
Server Routes:
10.16.0.2 dev tun0 proto kernel scope link src 10.16.0.1
10.16.0.0/24 via 10.16.0.2 dev tun0
Client Address:
inet 10.16.0.6 peer 10.16.0.5/32 scope global tun1
Client Routes:
10.16.0.1 via 10.16.0.5 dev tun1
10.16.0.5 dev tun1 proto kernel scope link src 10.16.0.6
172.16.0.10 via 10.16.0.5 dev tun1
and the clients can't communicate with each other using their VPN addresses.
However, if the clients manually add a route to include the whole VPN subnet, eg.:
172.16.0.0/24 via 10.16.0.5 dev tun1
they can then communicate with each other via the VPN network.
Is there a way to prevent the client to client communications, even if they manually manipulate their routing tables?
Thanks in advance.
