How to restrict openvpn route at server side even if client side using no-pull

Tintervenor

11/12/23, 2:54 AM

I know that client side openvpn configuration can use route-nopull and write theirselves route. But this may cause some secure problem, for example when you don't want to let vpn user visit some node through vpn gate.

So how to restrict route scope at server side even if vpn user modify their client configuration and write self-defined route?

404

1 + 0

openvpn

Score:2

Server

A. Trevelyan

11/22/23, 2:55 AM

As far as I understand it, route scope is specified in the server.conf file, like this for example:

# Add route to Client routing table for the OpenVPN Server 
push "route 10.8.0.1 255.255.255.255" 
# Add route to Client routing table for the OpenVPN Subnet 
push "route 10.8.0.0 255.255.255.0"

This tells your VPN gateway exactly what routes to push to connected clients.

If you're concerned about some malicious client configuring a static route at the client side to send additional traffic through the VPN tunnel, you cannot stop this, unless you have administrative control of their machine and can prohibit them from manipulating the routing table directly.

However, you can do though is ensure that your firewall on the VPN gateway is configured to only permit the traffic that you want to pass through. Assuming you're using just a regular linux box with the typical iptables/ufw as your VPN gateway, you would just need to make sure those are configured with specific rules identifying exactly what traffic should be allowed, and then everything else would be blocked, so even if a user does send some unexpected traffic over the tunnel, your gateway just drops it.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to restrict openvpn route at server side even if client side using no-pull

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.