In OpenVPN (PiVPN is OpenVPN).
What you is a combination of firewall/iprules and split tunneling.
The firewall to prevent clients accessing anything else in the LAN that is behind firewall.
The split tunneling will allow the clients to be able to use the VPN only for the services behind the VPN and the client's local LAN for the rest of traffic (otherwise they are locked to the services on the VPN only and will not be able to access anything else).
Regarding the firewall, best approach is to have dedicated physical firewall. However fastest thing to do is to set up
iptables on the server running the OpenVPN in the following manner:
- Allow allready established traffic to flow tun0<->eth0
iptables -A FORWARD -i tun0 -o eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- Disallow client to client traffic
iptables -A FORWARD -i tun0 -s 192.168.1.0/24 -d 192.168.1.0/24 -j DROP
- Allow traffic to services subnet
iptables -A FORWARD -i tun0 -s 192.168.1.0/24 -d 18.104.22.168/24 -m conntrack --ctstate NEW -j ACCEPT
- Accept traffic to the
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
You can use the step 3 to limit the traffic to single service (ex. 22.214.171.124/32) if you need more granularity
Note: Change the IP addresses and add additional rules based on your topology
What you need to do to enable the split tunnel is the following:
Stop the default route redirection
The server will push something like
push "redirect-gateway def1" during connection setup. This will add a route 0.0.0.0 to the established vpn, so all traffic will be diverted toward the vpn. You will need to prevent this, so either remove the
push from the server script or add to the client config
pull-filter ignore "redirect-gateway" to tell the client to ignore what the server is sending. For more information on blocking routes check this answer
Add the routes to the LAN that you want to use for the VPN
The server will usually send the routes behind the VPN as
push "route 192.168.1.0 255.255.255.0". Add your routes to the list in the server config (on the server side), or on the client side by adding
route 192.168.1.0 255.255.255.0 to the client config.