Openvpn client must access only to certain ip

[charneval]

Hello to all,
I configured a pfSense 2.4.3-RELEASE-p1 firewall as a server for two clients OpenVPN .
My network is: 10.20.0.0/24 and the network I use for the two VPNs is 172.16.8.0/24 and 172.16.9.0/24.
The openvpn clients connects correctly and sees the whole 10.20.0.0/24 network.
My requirement is to make a rule in the firewall to authorize the two OpenVpn clients only to certain IP types 10.20.0.101-108 (for a client) and 10.20.0.109-150 (for other clients).
I created the two ip groups and created a filtering rule in the OpenVpn tab but the client always manages to see the whole main network.

Do you have any advice?

THANK YOU

[johnpoz]

lets see your rules in your openvpn tab

[charneval]

Hello.
I sent the configuration of my openvpn rules....

[johnpoz]

I see no hits on those rules the 0/0 B in each rule. And you are not limiting source to the tunnel networks. So either both vpn clients would would be able to hit any of those aliases.

Keep in mind that rules are evaluated top down first rule to trigger wins no other rules are evaluated.. So if client X wants to get to say 10.20.0.106, its not listed in first rule, but it would be allowed in second rule.

Also keep in mind if you had any existing states would be allowed.. What IP are you saying you can get to?

If you want to limit your different vpn clients to different hosts then you would need to limit the rules via the source network they would be coming from, ie the tunnel network you assigned to your different vpns

[charneval]

@johnpoz said in Openvpn client must access only to certain ip:

ource

Thanks.
I check the rules in the tab OpenVpn and I put the correct network in the source and now working correctly.

THANKS ......

[johnpoz]

np glad you got it sorted.