OpenVPN Firewalling User specific
-
In the OpenVPN firewall section is it possible to firewall per user ( rather than IP or Port )
They are allocated random WAN IP Addresses so I dont know who is who
and only certain users should be able to get to certain systems -
Sorry that should obviosuly be LAN IP Addresses
-
@TSO2
I doubt pfSense will ever have user based rules.But you could make a DHCP reservation based on MAC-Address , so the DHCP server will always hand out the same ip , to the same MAC-Addresss (netcard)And then filter on that specific ip addressI missed the OpenVPN part , see viragoman's post below for a solution
-
@TSO2 said in OpenVPN Firewalling User specific:
They are allocated random WAN IP Addresses so I dont know who is who
The are allocated an IP out of the VPN tunnel network, except you're running the server in tap mode and have it bridged to an interface.
To allocate a specific IP to a certain user you can configure client specific overrides based on the username or the common name in his SSL certificate.
@TSO2 said in OpenVPN Firewalling User specific:
and only certain users should be able to get to certain systems
However, for a view groups of users I'd set up a separate OpenVPN server for each group. Each with a unique tunnel network. So it's easy to assign a specific rules to a user group.
-
@viragomann said in OpenVPN Firewalling User specific:
@TSO2 said in OpenVPN Firewalling User specific:
They are allocated random WAN IP Addresses so I dont know who is who
Wan was changed to Lan , in OP's next post.
-
@bingo600 said in OpenVPN Firewalling User specific:
Wan was changed to Lan , in OP's next post.
That doesn't matter, whether WAN nor LAN makes any sense to me
, except the server is in tap mode.
But for tap he will get rarely support here. -
@viragomann
Dooh
My mistake i totally missed the OpenVPN part ...
Assigned & LAN triggered DHCP in my mindset
-
@bingo600
And I was wondering, you're taking up a lot of work gathering all the MACs of virtual VPN adapters the clients have in use.
-
That is interesting and something I hadnt thought about,
Assigning user groups per subnet,
As they all have already been applied and distributed that will take some work,
But it is a solution
Thank you
