OpenVPN Support Forum

Hi,

I've recently installed an OpenVPN server, with the below configuration. The regular clients receive their IP from this subnet : 10.8.0.0/24
and the "Admin" client gets his IP from his file in /etc/openvpn/ccd (its in the 10.9.0.0./24 subnet).

I'd like to allow only the "admin" client to be able to communicate with all the other clients (i.e. ping, ssh, rdp and so on...),
but not allowing the "regular" clients to communicate with each other (like the default conf)

anyway, I've tried to play with iptables to achive that, but i can't get it right.

please help
many thanks in advance.

hi there,

AFAIK when client-to-client is enabled the traffic between
clients cant handled with iptables....

i am not sure that you can accomplish this.

Michael.

well that's the point.
i don't want to use "client-to-client" because it makes all clients see all the others.
any other ideas ? (and thanks for your reply anyway of course, any help is appreciated)

if 'client-to-client' is enabled you bypass all iptables rules, so this you don't want.
when assigning an IP from a different block then the 'server' block to a client you need to make sure that routing still works. I don't recommend to use and an admin range of 10.9.0.X but I'd use and an admin range of 10.0.9.X

first make sure all clients can see each other, including the admin client.
Then enable forwarding on the server and set up iptables rules to block connections between VPN clients except for the admin client. This is, BTW, explained in my book