Multiple OpenVPN Servers, restrict LAN Access

[latency0ms]

Dear netgate Community

I have two working OpenVPN servers set up, OVPN1 and OVPN2.

I use OVPN1 for the administration of the internal servers while OVPN2 is used exclusively as an IPv4 gateway.

OVPN1 is allowed to have access to all internal networks. With OVPN2 I want a configuration that suppresses access to all internal networks only using IPv4 Gateway functionallity.

OPVN1 > ALLOW ANY (LAN)
OVPN2 > BLOCK (LAN) ALLOW IPv4 Gateway

Any advice will be greatly appreciated.

[viragomann]

@latency0ms
Best practice is to create an alias and add all private network ranges to it, call it e.g. RFC1918.

Then add a block rule to the top of the OpenVPN tab:
source: OVPN2 tunnel network
destination: RFC1918 alias

For upstream from OVPN2 you also need an outbound NAT rule on WAN if you didn't add it already.