I've installed OpenVPN Access Server on my Ubuntu box at home. It's set up so that I can connect my website hosted on the box, log in, and download the client. The Admin site is not port-forwarded and is only accessible from the local network.

There are three things that I'd like to accomplish:

1) Lock it down.

Right now all you need to do is brute force the username / password and you can get into my whole network. When I set up SSH on my box, I had it use a private key and password so it's much harder (or practically impossible) to brute force. Is there anything I can do to similarly improve the security of OpenVPN?

2) Separate internet tunneling from private network access.

I'd like to be able to create a more limited account that only gets it's internet connection forwarded to improve wireless security when on a public/untrusted network away from home, while at the same time keeping the user separate from my home network.

3) Decouple the OpenVPN users from my local users.

Right now it seems OpenVPN is in a mode that authenticates to the users on my box. I'd like to separate this and have OpenVPN maintain it's own list.

How can I accomplish these three goals?

(ps. I'm a newbie at OpenVPN and networking in general)


You can use User Certificates to "Lock Down" your VPN and you can separate your private lan users from the VPN ones by NOT using the client-to-client directive in your .conf file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.