2

I have a Raspberry PI running PiVPN and would like to restrict the LAN IP addresses that can be accessed through the VPN, so that only one service is available.

I have searched, but all I have found is for a PTPP VPN, which I don't believe would help.

Improve this question
2
  • If I am not mistaken, PiVPN is based on OpenVPN. See this for details on how to configure OpenVPN with restrictions. – Robert Feb 23 at 8:25
  • I'm assuming you've configured OpenVPN as TUN, not TAP, so you should have a separate subnet for the VPN and LAN - if so, you'd likely have to do so via iptables, as route directives can be added to either the client's or server's config, preventing this from being done through OpenVPN itself. – JW0914 Feb 23 at 14:15
0

In OpenVPN (PiVPN is OpenVPN).

What you is a combination of firewall/iprules and split tunneling.

  • The firewall to prevent clients accessing anything else in the LAN that is behind firewall.

  • The split tunneling will allow the clients to be able to use the VPN only for the services behind the VPN and the client's local LAN for the rest of traffic (otherwise they are locked to the services on the VPN only and will not be able to access anything else).

Regarding the firewall, best approach is to have dedicated physical firewall. However fastest thing to do is to set up iptables on the server running the OpenVPN in the following manner:

  1. Allow allready established traffic to flow tun0<->eth0
iptables -A FORWARD -i tun0 -o eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  1. Disallow client to client traffic
iptables -A FORWARD -i tun0 -s 192.168.1.0/24 -d 192.168.1.0/24 -j DROP
  1. Allow traffic to services subnet
iptables -A FORWARD -i tun0 -s 192.168.1.0/24 -d 192.16.2.0/24 -m conntrack --ctstate NEW -j ACCEPT
  1. Accept traffic to the tun0 adapter
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT

You can use the step 3 to limit the traffic to single service (ex. 192.16.2.231/32) if you need more granularity

Note: Change the IP addresses and add additional rules based on your topology

What you need to do to enable the split tunnel is the following:

  1. Stop the default route redirection

    The server will push something like push "redirect-gateway def1" during connection setup. This will add a route 0.0.0.0 to the established vpn, so all traffic will be diverted toward the vpn. You will need to prevent this, so either remove the push from the server script or add to the client config pull-filter ignore "redirect-gateway" to tell the client to ignore what the server is sending. For more information on blocking routes check this answer

  2. Add the routes to the LAN that you want to use for the VPN

    The server will usually send the routes behind the VPN as push "route 192.168.1.0 255.255.255.0". Add your routes to the list in the server config (on the server side), or on the client side by adding route 192.168.1.0 255.255.255.0 to the client config.

Improve this answer
7
  • Split tunneling wouldn't prevent a VPN client from accessing LAN clients, as route directives can be added to the client's or server's config; doing so would need to be done via iptables (or other firewall being used) on the machine the OpenVPN server is running on. The purpose of split tunneling is "...traffic that is destined for the subnets on your Internal LAN will go through the VPN tunnel. Other traffic will go through [the] normal Internet connection." – JW0914 Feb 23 at 14:24
  • Sure, this will work from the client side to allow client to access the LAN from VPN and rest from normal connection. To restrict the VPN on server side to specific IP, remove all push "route" and replace them with the IP addresses/ranges that need to be accessed. – jordanvrtanoski Feb 23 at 14:42
  • 1
    The only traffic that can be outrightly firewalled via OpenVPN is clients from communicating with one another, as it controls its own subnet routing; all other firewalling must be done via the machine's firewall the OpenVPN server is running on. You can't prevent a client from accessing another subnet because route's can be specified in the client's config (all the push directives do in the server config is allow the client config to be smaller by not having to list the parameters being pushed in the client config itself - removing them doesn't prevent the client from specifying them). – JW0914 Feb 23 at 14:48
  • Depending on the level of security that is required. Yes the client can change the routes and access some of the services (depending on the topology). If the question is for a security, then the only solution is to place the services an isolated zone and put firewall in front of them. Everything else can be easily compromised. – jordanvrtanoski Feb 23 at 14:52
  • The only topology that should be used is subnet, as Net30 was depreciated years ago. The most efficient way to do what the questioner asked is via a handful of iptables commands (or whatever firewall the machine is running) that allow traffic to a specific LAN IP and port from the VPN's subnet, with the next rule blocking all other traffic between the two. Either way, this answer will not firewall VPN client traffic from accessing LAN, as that is not what split tunneling does (per the link provided in your answer) – JW0914 Feb 23 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.