Different vlan for different user through vpn

marco.zanca

Hi, I just recently installed ClearOS, it's a gateway solution which implements, besides other things, openvpn. I've successfully configured a routered vpn. There is one thing I failed to configure, but perhaps it is not possible to do or does not make much sense in these terms.

My situation is this:

eth0 -> 192.168.1.1 -> modem -> internet (ADSL)
eth1 -> 192.168.10.1 | -> switch with VLAN support  | -> LAN1 (vlan 1 192.168.40.0/24)
                                                    | -> LAN2 (vlan 2 192.168.50.0/24)

In ClearOs there is a ldap server, so i created 2 groups of users. I would like that users in Group 1 had access via VPN only to vlan1, and users in the group 2 only to vlan2.

It is possible to make this configuration? Does it make sense? It's something i can do with openvpn settings, or it's more like a iptables rule?

Regards
Marco

Mimiko

Yes. Use ccd files. For each client that will connect create a ccd file with option 'push "route 192.168.x.0 255.255.255.0"'.
But this will not secure against manual adding on client route to the other vlan. So for enhanced sequrity also use --client-connect option.

janjust

I'm not sure if it's possible to pass vlan-tagged frames over the VPN , but it's not really necessary either.
As mimiko stated, use a 'client-connect' script to assign different IP ranges to the different clients. use iptables on the VPN server to ensure that no rogue clients from pool A can grab or reach IPs in pool B and vice versa.

marco.zanca

Ok, thank for your replies. I'll try to use the client-connect option.