2
1
I'm running OpenVPN 2.3.2 (still a newbie at this) in an Ubuntu 14.04 Server machine. I want to be able to disable/reenable clients that connect to my OpenVPN server.
I followed this guide for revoking a client's certificate, but it seems that this move is irreversible. Also, if I revoke a client's certificate, and the client is already connected, the connection does not seem to stop. I want the connection to stop immediately.
Is there any easy way to disable and reenable clients?
My server.conf file:
# OpenVPN server configuration file
dev tun
proto udp
port 1194
server 10.8.0.0 255.255.255.0
ca /usr/share/easy-rsa/keys/ca.crt
cert /usr/share/easy-rsa/keys/vpnserver.crt
key /usr/share/easy-rsa/keys/vpnserver.key
dh /usr/share/easy-rsa/keys/dh2048.pem
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
comp-lzo
keepalive 10 60
persist-tun
persist-key
user panos
group panos
log-append /var/log/openvpn.log
verb 3
# crl-verify keys/crl.pem
The last line is for the guide above.
Thank you.
Why not assign IP addresses per user and then use iptables to block/allow IP? – davidgo – 2017-08-27T16:42:51.067
I don't know. I think that the solution you suggest is a little bit "dirty". Iptables is something irrelevant than the VPN mechanism. Also if someone has a way to change his IP then he could easily re-connect with the same certificate. – panos – 2017-08-28T18:02:07.217
I'd just point out that I'm suggesting that the IP blocked is the one issued by the VPN server - so - if correctly set up server side the user could not reconnect with the same cert. – davidgo – 2017-08-28T22:25:19.127