How can I define separate roles for users and administrator in OpenVPN running on CentOS 7 server? Specifically, the users must only be allowed to
https, while the administrator must be allowed to both
PROGRESS SO FAR:
In translating the instructions from the link suggested by @garethTheRed, I have defined the following steps. I have also completed steps one, two, and three. But I do not know how to complete step four. Can someone please show how to translate STEP FOUR into firewalld from iptables, and also confirm the other steps?
Step One (COMPLETED): Create a virtual IP address map according to user class:
Class Virtual IP range Allowed Services employees 10.8.0.0/24 https administrator 10.8.1.0/24 ssh, https
Step Two (COMPLETED): In /etc/openvpn/server.conf,
define the Employee IP address pool: server 10.8.0.0 255.255.255.0 Add a route for the System Administrator IP range: route 10.8.1.0 255.255.255.0 Specify client configuration directory to assign a fixed IP forAdministrator: client-config-dir ccd
Step Three (COMPLETED): In a new directory
/etc/openvpn/ccd and new config file
Define the fixed IP address for the Administrator VPN client: mkdir ccd cd ccd nano sysadmin1 type the following into /etc/openvpn/ccd/sysadmin1: ifconfig-push 10.8.1.1 10.8.1.2
Step Four (HOW DO I DO THIS IN FIREWALLD SO THAT USERS CAN ONLY
https AND SO THAT ADMINISTRATOR CAN
First, define a static unit number for our tun interface: dev tun0 //where does this go? Establish firewall rules for the employees and administrator (convert these to firewalld): # Employee rule // MUST ONLY BE ALLOWED TO https iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.66.4.4 -j ACCEPT # Sysadmin rule //MUST BE ALLOWED TO ssh AND https iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 10.66.4.0/24 -j ACCEPT
Note: When I type
firewall-cmd --list-all, the sum total of the entire firewalld configuration so far is defined as follows:
public (default, active) interfaces: enp3s0 sources: services: dhcpv6-client openvpn smtp ports: masquerade: yes forward-ports: icmp-blocks: rich rules:
I would like to change the firewall configuration in any way required to provide optimal security for this use case.
How do I modify the above to get this working?
After reading @garethTheRed's helpful answer, I have three questions/observations:
1.) There is no `tun` device on the firewall, but yet I am able to connect to the VPN from the client with `openvpn --config /path/to/client.ovpn` with the firewall configured only as shown by the results of `firewall-cmd --list-all`. So why is it necessary to define a `tun` device in the firewall? 2.) `ip addr` shows that I was logged in as 10.8.0.6. How can I force being logged in as a fixed address, such as 10.8.1.1 defined in Step Three above? 3.) What privileges/access does a user really have when they log in to the server via OpenVPN when the firewall is configured as shown in the results of `firewall-cmd --list-all` above? Are they be able to do anything other than https without a password anyway? ssh would require knowledge of both a password and a username.
In the internal zone defined in @garethTheRed's very helpful answer, it would seem that the users of the internal zone have access to the following services
ssh. The use case in this posting would also include
Therefore, it would seem that the solution to this posting would involve:
1.) setting up rules blocking the `10.8.0.0/24` ip range from `dhcpv6-client`, `ipp-client`, `mdns`, `samba-client`, and `ssh`, while allowing access to `https`. 2.) retaining access by the `10.8.1.0/24` ip range to all services defined in the internal zone. 3.) creating and installing separate client certificates for the two classes of users (administrator and user)? Each class, and therefore each certificate, must have a Canonical Name (CN) that matches the names of config files added to `/etc/openvpn/ccd`. Openvpn should then use the config file whose name matches the CN. This config file should be set to configure the network address that will be allocated to the clients in that class @garethTheRed's words are used here in #3.
But are these 3 things what are still required to complete this requirement? And how do I accomplish these 3 things?