Controll networksegment access based on usergroups via OpenVPN

[yannik.hinteregger]

Hi,

if i had a network like the one in the model.
The network can be accessed via OpenVPN. Furthermore the pfSense is linked to the windows domain via LDAP.
So every Domain-User has the ability to use OpenVPN with his AD-Credentials.

My question is: Is it possible to give users access to specific VLANs using AD-Groups. E.g.: A user of the group admin is able y to access every device on every VLAN, while a user of the group client is can only access the Service and Client VLAN.

Thanks!

[JKnott]

You'd need some way to tell the user's devices which VLAN to connect to. There is DHCP option 43, but that's based on MAC address. By the time a user logs in, it's too late. The normal way to restrict access is to configure it in Active Directory. Why do you think you have to do it with VLANs?