Setting Up OpenVPN with Different Subnets for Multiple Groups

Here is a detailed explanation on how to set up multiple independent OpenVPN servers and prevent users from accessing specific subnets.

Prerequisites

• A server with multiple network interfaces.
• OpenVPN server software installed on each interface.
• A client configuration file for each user.

Setting up OpenVPN servers

1. Install OpenVPN server software on each network interface.

   For Ubuntu, you can use the following command:

   sudo apt-get install openvpn easy-rsa
   

2. Configure the server on each interface.

   Navigate to the EasyRSA directory:

   cd ~/EasyRSA-3.0.8
   ./easyrsa init-pki
   ./easyrsa build-ca nopass
   

   Then, create a server key and certificate:

   ./easyrsa build-server-full server nopass
   

   After that, copy the key and certificate files to the OpenVPN server configuration directory:

   sudo cp pki/private/server.key /etc/openvpn/
   sudo cp pki/issued/server.crt /etc/openvpn/
   

   Finally, create a server configuration file:

   sudo nano /etc/openvpn/server.conf
   

   Add the following lines:

   protocol udp
   port 1194
   proto tcp
   port 443
   ca ca.crt
   cert server.crt
   key server.key
   dh dh2048.pem
   server 10.8.0.0 255.255.255.0
   ifconfig-pool-persist ipp.txt
   push "redirect-gateway def1 bypass-dhcp"
   push "dhcp-option DNS 8.8.8.8"
   push "dhcp-option DNS 8.8.4.4"
   keepalive 10 120
   cipher AES-256-CBC
   comp-lzo
   user nobody
   group nogroup
   persist-key
   persist-tun
   status openvpn-status.log
   verb 3
   

   Replace 10.8.0.0 255.255.255.0 with the appropriate subnet for the interface.

3. Repeat the process for each network interface.

Setting up client configuration

1. Generate a client key and certificate:

   ./easyrsa build-client-full client
   

2. Create a client configuration file:

   sudo nano /etc/openvpn/client.conf
   

   Add the following lines:

   client
   dev tun
   proto udp
   port 1194
   remote your_server_ip 1194
   resolv-retry infinite
   nobind
   persist-key
   persist-tun
   ca ca.crt
   cert client.crt
   key client.key
   cipher AES-256-CBC
   comp-lzo
   

   Replace your_server_ip with the IP address of the OpenVPN server.

3. To prevent users from accessing specific subnets, add the following lines to the server configuration file:

   push "route 10.8.1.0 255.255.255.0"
   push "route 10.8.2.0 255.255.255.0"
   

   Replace 10.8.1.0 and 10.8.2.0 with the subnets you want to block.

Starting OpenVPN servers

Start the OpenVPN server on each interface:

sudo systemctl start openvpn@interface_name

Replace interface_name with the name of the network interface.

References

• OpenVPN: Server Configuration Guide
• OpenVPN: Client Configuration Guide
• Ubuntu: OpenVPN Server Installation
• OpenVPN: Push Routes

This output is plain HTML and valid.