Restricted access

[cccfran]

have set up openvpn on ubuntu 18.04 and created several users with success using https://github.com/angristan/openvpn-install. (I port forward from the router to the server.)

Now I am trying to set up restricted access following https://openvpn.net/community-resources ... -policies/.
I want 10.8.1.0/24 to only have access to 192.168.1.1. Here is what I have done.

0. Create client1 using https://github.com/angristan/openvpn-install with default setup and it works fine with private ip 10.8.0.6.
1. Add push "route 10.8.1.0 255.255.255.0" in server.config
2. For client1, I put "ifconfig-push 10.8.1.1 10.8.1.2" to ccd/client1
3. iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 192.168.1.1 -j ACCEPT

When try to connect on the client side, it returns the following error:

There was an error attempting to connect to the selected server. Error message: addr_pair_mask_parse_error: AddMaskPair parse error 'ifconfig' 10.8.1.1/10.8.1.2: ipv4_exception: malformed netmask 

Did I miss something? I notices that using the openvpn-install setup, client1 has private ip 10.8.0.6. Should I change it first to 10.8.0.1? Thanks in advance!

Here is my server.conf:

port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_VHUqGfuAvlL4Tbsh.crt
key server_VHUqGfuAvlL4Tbsh.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3
push "route 10.8.1.0 255.255.255.0"

[randshell]

2. For client1, I put "ifconfig-push 10.8.1.1 10.8.1.2" to ccd/client1

What are you trying to do with this line exactly? The syntax is ifconfig-push local remote-netmask like you did one the step 1.

[cccfran]

I am trying to assign local ip to client1 since step 1 does not have option to choose ip.

I think the procedure is off but i am not sure how to adopt openVPN instructions to openVPN-install.sh.

[randshell]

I think the only change you need to do is run iptables -I FORWARD 1 -i tun0 -s 10.8.1.0/24 -d 192.168.1.1 -j ACCEPT.

If it works then you can make this change permanent by inserting it in /etc/iptables/add-openvpn-rules.sh. After add iptables -D FORWARD -i tun0 -s 10.8.1.0/24 -d 192.168.1.1 -j ACCEPT in /etc/iptables/rm-openvpn-rules.sh to remove the iptables rule when the openvpn service is not running.