from: http://planetjoel.com/viewarticle/638/O ... membership
Go to his site for the download.
Posted by Joel (joelh-website at planetjoel dot com) on Friday, 14th of May, 2010 - 08:19:21 AM
I'm releasing two small perl scripts I wrote which provide the client-connect and client-disconnect scripts for OpenVPN such that you can dynamically create IPtables firewall rules based on LDAP group memberships. You push out routes to all your internal networks to the user then using IPtables only allow traffic to specific destinations and ports. This allows you to give out customized and limited VPN access, or VPN access based on roles.
Rules are looked up in an LDAP database using the common name of the certificate as the unqiueMember to a groupOfUniqeMembers. Details of how to install it are in the zip.
Currently it only supports TCP protocol. It could easily be extended to support other protocols.
Scripts with setup, destroy, and modify routing tables and firewall rulesets for client connections.
2 posts • Page 1 of 1