How can I define separate roles for users and administrator in OpenVPN running on CentOS 7 server? Specifically, the users must only be allowed to https
, while the administrator must be allowed to both https
and ssh
.
PROGRESS SO FAR:
In translating the instructions from the link suggested by @garethTheRed, I have defined the following steps. I have also completed steps one, two, and three. But I do not know how to complete step four. Can someone please show how to translate STEP FOUR into firewalld from iptables, and also confirm the other steps?
Step One (COMPLETED): Create a virtual IP address map according to user class:
Class Virtual IP range Allowed Services
employees 10.8.0.0/24 https
administrator 10.8.1.0/24 ssh, https
Step Two (COMPLETED): In /etc/openvpn/server.conf,
define the Employee IP address pool:
server 10.8.0.0 255.255.255.0
Add a route for the System Administrator IP range:
route 10.8.1.0 255.255.255.0
Specify client configuration directory to assign a fixed IP forAdministrator:
client-config-dir ccd
Step Three (COMPLETED): In a new directory /etc/openvpn/ccd
and new config file /etc/openvpn/ccd/sysadmin
:
Define the fixed IP address for the Administrator VPN client:
mkdir ccd
cd ccd
nano sysadmin1
type the following into /etc/openvpn/ccd/sysadmin1:
ifconfig-push 10.8.1.1 10.8.1.2
Step Four (HOW DO I DO THIS IN FIREWALLD SO THAT USERS CAN ONLY https
AND SO THAT ADMINISTRATOR CAN ssh
AND https
?):
First, define a static unit number for our tun interface:
dev tun0 //where does this go?
Establish firewall rules for the employees and administrator (convert these to firewalld):
# Employee rule // MUST ONLY BE ALLOWED TO https
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.66.4.4 -j ACCEPT
# Sysadmin rule //MUST BE ALLOWED TO ssh AND https
iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 10.66.4.0/24 -j ACCEPT
Note: When I type firewall-cmd --list-all
, the sum total of the entire firewalld configuration so far is defined as follows:
public (default, active)
interfaces: enp3s0
sources:
services: dhcpv6-client openvpn smtp
ports:
masquerade: yes
forward-ports:
icmp-blocks:
rich rules:
I would like to change the firewall configuration in any way required to provide optimal security for this use case.
How do I modify the above to get this working?
EDIT:
After reading @garethTheRed's helpful answer, I have three questions/observations:
1.) There is no `tun` device on the firewall, but yet I am able
to connect to the VPN from the client with
`openvpn --config /path/to/client.ovpn` with the firewall
configured only as shown by the results of `firewall-cmd --list-all`.
So why is it necessary to define a `tun` device in the firewall?
2.) `ip addr` shows that I was logged in as 10.8.0.6. How can I
force being logged in as a fixed address, such as 10.8.1.1 defined
in Step Three above?
3.) What privileges/access does a user really have when they log in to the
server via OpenVPN when the firewall is configured as shown in the
results of `firewall-cmd --list-all` above? Are they be able to do
anything other than https without a password anyway? ssh would
require knowledge of both a password and a username.
EDIT#2
In the internal zone defined in @garethTheRed's very helpful answer, it would seem that the users of the internal zone have access to the following services dhcpv6-client
, ipp-client
, mdns
, samba-client
, and ssh
. The use case in this posting would also include https
.
Therefore, it would seem that the solution to this posting would involve:
1.) setting up rules blocking the `10.8.0.0/24` ip range from
`dhcpv6-client`, `ipp-client`, `mdns`, `samba-client`, and `ssh`,
while allowing access to `https`.
2.) retaining access by the `10.8.1.0/24` ip range to all services
defined in the internal zone.
3.) creating and installing separate client certificates for the
two classes of users (administrator and user)? Each class,
and therefore each certificate, must have a Canonical Name (CN)
that matches the names of config files added to `/etc/openvpn/ccd`.
Openvpn should then use the config file whose name matches the CN.
This config file should be set to configure the network address
that will be allocated to the clients in that class
@garethTheRed's words are used here in #3.
But are these 3 things what are still required to complete this requirement? And how do I accomplish these 3 things?
.ovpn
files, I just added both of them to my OP. Does this help determine how to allowemployees
andadministrators
to usehttps
inside OpenVPN? – CodeMed Feb 20 '15 at 23:04