willec
Hello,
I've configured a OpenVPN Server in routed mode and I push different IP addresses (via ifconfig-push) to different kinds of clients. Behind my OpenVPN Server is a firewall, which filters traffic depending on the Clients VPN IP address. I'm now wondering whether it's possible to manually change the address on the client? Cause that would mean someone could assign an other IP and thereby could bypass my firewall rules.
I tried this for my self with a Windows Client, by just changing the IP of the TAP device and the according routing information. It didn't work, which is good. Does someone know whether this is possible in any other way? Cause than my security concept is not secure at all.
br
Christian
Mimiko
Hello.
If the OpenVPN server and firewall is not on the same system, then the firewall is not aware about IP's that gets TAP interface. VPN is a secure way to transmit data, so the IP's are encrypted in packets transmited from one OpenVPN to other.
willec
Hello Mimiko,
I'm talking about the traffic going through the tunnel. The client gets an IP (TUN/TAP interface) with which it is accessing the remote network (the networks behind my OpenVPN Server) So firewalling this traffic is important for me, cause I want different rules for different clients.
br
Mimiko
Maybe a diagram of the network will clarify your needs.
