Openvpn which template to use for server

Installing and Using OpenWrt Network and Wireless Configuration
1

hello, thanks, i want to run openvpn server on my openwrt router.

there are a few templates for the server but not sure which to use for my need?

  1. multiple client users
  2. each user should be default deny, no access to internal machines.
  3. use firewall, to allow a specific user to access a specific machine at a specific port.

{183E6294-8399-4C51-AE4F-2F6D1A0525FC}

2

That is correct but I would use WireGuard, much easier to setup especially for what you want (client access by their IP address):
https://openwrt.org/docs/guide-user/services/vpn/wireguard/road-warrior

general server:
https://openwrt.org/docs/guide-user/services/vpn/wireguard/server

2 Likes
3

thanks much for the suggestion, but i am asking only about openvpn.

i am switching away from opnsense, they have a great openvpn road warrior setup.
including "Multi Factor Authentication ( Client Certificate + Password + OTP )"
https://docs.opnsense.org/manual/how-tos/sslvpn_client.html

that is what i am trying to replicate in openwrt.

so, i wanted to know which openvpn server configuration template is the closest to my use-case?
i think, but now sure, to choose "Server configuration for a routed multi-client VPN" ?

image

4

Yes that is the one, good luck with it.
But it sure is a lot of work, you need ccd files per client and the password plugin.

5

Yes the "routed multi client" is this use case.

I don't know if OpenVPN has strict enforcement of user's IPs like Wireguard's allowed_ips mechanism does. If you're going to use a source IP based firewall to separate different classes of users on the same interface, you have to be sure that a malicious user can't elevate their privilege by changing the IP on their end.