Dear community,
I am really struggeling to configure my PiVPN Server to give a friend access only to the internet through my VPN Tunnel without access to my local network. I read a lot of articles and thought its totally easy...
Currently my server.conf looks like:
dev tun
proto udp
port XXXXX
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_XXXXXX.crt
key /etc/openvpn/easy-rsa/pki/private/server_XXXXX.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 192.168.XXX.XXX"
push "dhcp-option DNS XXX.XXX.XXX.XXX"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 10 120
remote-cert-tls client
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io
client-config-dir ccd
In the server.conf I manually added the last line:
client-config-dir ccd
Than I created the folder ccd in /etc/openvpn/
sudo mkdir /etc/openvpn/ccd
I created the file like my VPN user was named (same I used for pivpn add e.g.: TEST) and the file TEST in /etc/openvpn/ccd contains the following:
ifconfig-push 10.9.0.1 255.255.255.0
To limit the acces of the client with IP 10.9.0.1 to my local network 192.169.XXX.XXX I added the following iptable rules:
sudo iptables -t nat -A POSTROUTING -o eth0 -s 10.9.0.0/24 -j MASQUERADE
sudo iptables -I FORWARD -i tun0 -o etho -s 10.9.0.0/24 -d 192.168.XXX.0/24 -j DROP
The user can connect successful to my VPN and receives the IP 10.9.0.1. Client has access to internet but the user still has access to my local network an all devices. How can I limit the user to have access to my local network and only allow internet traffic?
Many thanks in advance and best regards
sTaNy
