What is the best way to do user based VPN access.
-
After looking around for 2 days now I have not found a clear cut answer to my problem. Any help is welcome.
Here is my server:
LAN: PC network no VLAN
OPT1: 4x VLAN each with groups of server. These VLAN are blocked from talking to each other as they are setup for different friends to host servers.My Goal: I'm looking for the best way to grant Client-to-Site (Site-to-Site might come later if there is a need) VPN access to each of these VLAN's and the LAN. Some Users should only have access to only one VLAN while others should have access to 2 or more of the VLANs.
Thank you for your help.
-
If there are only a couple of categories of user, then you can set up an OpenVPN server for each, listening on a different port with different certificate/s and tunnel subnet. Then you can easily control firewall rules on OpenVPN for those subnets.
Or you can have a single OpenVPN server and use Client Specific Overrides to allocate a particular tunnel IP to a particular client certificate. Then the rules can be based on those tunnel IPs.
Any other permutations of this?
-
If there are only a couple of categories of user, then you can set up an OpenVPN server for each, listening on a different port with different certificate/s and tunnel subnet. Then you can easily control firewall rules on OpenVPN for those subnets.
Or you can have a single OpenVPN server and use Client Specific Overrides to allocate a particular tunnel IP to a particular client certificate. Then the rules can be based on those tunnel IPs.
Any other permutations of this?
I was looking at the Client Specific Override, but didn't see a way to assign them to a client Certificate. The documentation I found wasn't 100% clear on that part.
OpenVPN multi purpose single server -
After making the internal CA, you make a server certificate for the server end, and a client certificate for each client (user). Then use the name of the client certificate in "common name" in the client specific overrides entry.
Then give each client/user just their own certificate.
Also, in the server settings, check "Strict User/CN Matching" - "When authenticating users, enforce a match between the common name of the client certificate and the username given at login". Then if a client person gets hold of someone else's client certificate they cannot use their own user-password with that other certificate to try and impersonate the other user and gain the other user's access/IP.