multiple user-types/access-rules for OpenVPN on CentOS 7 and firewalld

Question

How can I define separate roles for users and administrator in OpenVPN running on CentOS 7 server? Specifically, the users must only be allowed to https, while the administrator must be allowed to both https and ssh.

PROGRESS SO FAR:

In translating the instructions from the link suggested by @garethTheRed, I have defined the following steps. I have also completed steps one, two, and three. But I do not know how to complete step four. Can someone please show how to translate STEP FOUR into firewalld from iptables, and also confirm the other steps?

Step One (COMPLETED): Create a virtual IP address map according to user class:

    Class            Virtual IP range       Allowed Services  
    employees        10.8.0.0/24            https
    administrator    10.8.1.0/24            ssh, https  

Step Two (COMPLETED): In /etc/openvpn/server.conf,

    define the Employee IP address pool:
    server 10.8.0.0 255.255.255.0

    Add a route for the System Administrator IP range:
    route 10.8.1.0 255.255.255.0

    Specify client configuration directory to assign a fixed IP forAdministrator:
    client-config-dir ccd

Step Three (COMPLETED): In a new directory /etc/openvpn/ccd and new config file /etc/openvpn/ccd/sysadmin:

    Define the fixed IP address for the Administrator VPN client:

        mkdir ccd
        cd ccd
        nano sysadmin1
        type the following into /etc/openvpn/ccd/sysadmin1:
        ifconfig-push 10.8.1.1 10.8.1.2

Step Four (HOW DO I DO THIS IN FIREWALLD SO THAT USERS CAN ONLY https AND SO THAT ADMINISTRATOR CAN ssh AND https?):

    First, define a static unit number for our tun interface:

        dev tun0  //where does this go?

    Establish firewall rules for the employees and administrator (convert these to firewalld):
        # Employee rule // MUST ONLY BE ALLOWED TO https
        iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.66.4.4 -j ACCEPT

        # Sysadmin rule //MUST BE ALLOWED TO ssh AND https
        iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 10.66.4.0/24 -j ACCEPT

Note: When I type firewall-cmd --list-all, the sum total of the entire firewalld configuration so far is defined as follows:

public (default, active)
  interfaces: enp3s0
  sources: 
  services: dhcpv6-client openvpn smtp
  ports: 
  masquerade: yes
  forward-ports: 
  icmp-blocks: 
  rich rules: 

I would like to change the firewall configuration in any way required to provide optimal security for this use case.

How do I modify the above to get this working?

EDIT:

After reading @garethTheRed's helpful answer, I have three questions/observations:

1.) There is no `tun` device on the firewall, but yet I am able  
    to connect to the VPN from the client with  
    `openvpn --config /path/to/client.ovpn` with the firewall  
    configured only as shown by the results of `firewall-cmd --list-all`.
    So why is it necessary to define a `tun` device in the firewall?  

2.) `ip addr` shows that I was logged in as 10.8.0.6.  How can I 
    force being logged in as a fixed address, such as 10.8.1.1 defined  
    in Step Three above?  

3.) What privileges/access does a user really have when they log in to the  
    server via OpenVPN when the firewall is configured as shown in the  
    results of `firewall-cmd --list-all` above?  Are they be able to do  
    anything other than https without a password anyway?  ssh would  
    require knowledge of both a password and a username.  

EDIT#2

In the internal zone defined in @garethTheRed's very helpful answer, it would seem that the users of the internal zone have access to the following services dhcpv6-client, ipp-client, mdns, samba-client, and ssh. The use case in this posting would also include https.

Therefore, it would seem that the solution to this posting would involve:

1.) setting up rules blocking the `10.8.0.0/24` ip range from  
    `dhcpv6-client`, `ipp-client`, `mdns`, `samba-client`, and `ssh`,  
    while allowing access to `https`.  

2.) retaining access by the `10.8.1.0/24` ip range to all services  
    defined in the internal zone.  

3.) creating and installing separate client certificates for the  
    two classes of users (administrator and user)? Each class,  
    and therefore each certificate, must have a Canonical Name (CN)  
    that matches the names of config files added to `/etc/openvpn/ccd`.  
    Openvpn should then use the config file whose name matches the CN.  
    This config file should be set to configure the network address  
    that will be allocated to the clients in that class
    @garethTheRed's words are used here in #3.  

But are these 3 things what are still required to complete this requirement? And how do I accomplish these 3 things?

Answer 1

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet.

Find which zone your tun interface is in by listing all zones:

firewall-cmd --list-all-zones | less

In the output you should see something similar to:

internal (active)
  interfaces: tun0
  sources: 
  services: dhcpv6-client ipp-client mdns samba-client ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules:

You may find that the tun device (tun0 in the example above) is in the same zone as your ethernet adapter. While this will work, it will be easier to manage if you separate them.

It would be wise to remove the service that you don't need from the internal zone - in your case, remove all but ssh and also add http:

firewall-cmd --zone=internal --permanent --add-service=http
firewall-cmd --zone=internal --permanent --remove-service=dhcpv6-client

Repeat the last command with the other services you want to remove. Make sure you don't remove ssh! While you're at it, remove redundant services from your external zone too.

Copy the zone definition file from the zone where the tun interface is located to /etc/firewalld/zones. For example, if the tun device is in the Internal zone:

sudo cp /usr/lib/firewalld/zones/internal.xml /etc/firewalld/zones

Edit the copied file and add the following just before the closing </zone>:

<rule family="ipv4">
    <source invert="True" address="10.8.0.0"/>
    <service name="ssh"/>
    <reject/>
</rule>

Finally, run firewall-cmd --reload to apply the rule.

Warning: You may lock yourself out if this doesn't work :-o

Alternative Options:

Another, simpler option, would be to configure sshd to only accept connections from a given network address - 10.8.0.0.

An even simpler option would be to abandon the VPN altogether and only use the firewall. If (and only if) your employees (or your external router) have a static IP address then simply configure Rich Rules to allow only their IP address or network address to reach the ssh service while rejecting all other IP addresses.