Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've installed OpenVPN Access Server on my Ubuntu box at home. It's set up so that I can connect my website hosted on the box, log in, and download the client. The Admin site is not port-forwarded and is only accessible from the local network.

There are three things that I'd like to accomplish:

1) Lock it down.

Right now all you need to do is brute force the username / password and you can get into my whole network. When I set up SSH on my box, I had it use a private key and password so it's much harder (or practically impossible) to brute force. Is there anything I can do to similarly improve the security of OpenVPN?

2) Separate internet tunneling from private network access.

I'd like to be able to create a more limited account that only gets it's internet connection forwarded to improve wireless security when on a public/untrusted network away from home, while at the same time keeping the user separate from my home network.

3) Decouple the OpenVPN users from my local users.

Right now it seems OpenVPN is in a mode that authenticates to the users on my box. I'd like to separate this and have OpenVPN maintain it's own list.


How can I accomplish these three goals?

(ps. I'm a newbie at OpenVPN and networking in general)

share|improve this question
add comment

1 Answer

You can use User Certificates to "Lock Down" your VPN and you can separate your private lan users from the VPN ones by NOT using the client-to-client directive in your .conf file.

share|improve this answer
    
But can't a user just download their user certificate from the client login page? –  John Jul 29 '13 at 21:16
    
No. The server has to create and sign the certificate. Take a look here: openvpn.net/index.php/open-source/documentation/howto.html#pki –  Krishath Jul 29 '13 at 22:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.