Site-to-site OVPN - block specific IP range on server side from reaching client side?

[maxbraketorque]

I have been using firewall-start to block a specific IP range on the server side of my site-to-site OVPN connections from reaching the client side. Is there a way to implement this directly in OVPN, either on the server side or client side configurations?

 

[ColinTaylor]

Can you post your current firewall-start rules so we can fully understand what you're asking for?

 

[maxbraketorque]

Can you post your current firewall-start rules so we can fully understand what you're asking for?

This relates to the question I asked a few days about about using firewall-start on stock firmware. Asusmerlin no longer supports the AC68U, but Asus keeps cranking up updated stock firmwares for the AC68U. The only feature that I really use for Asusmerlin on my AC68U is firewall-start to block a specific range of IP addresses on the OVPN server side from reaching the client side. The firewall-start rule on the server side is:

iptables -I FORWARD -s 192.168.37.128/26 -d 192.168.38.0/24 -j DROP

37 is the server side (the AC68U), and 38 is the client side (another Asus router at a remote location). Can I accomplish the same thing using an OVPN configuration command?

 

[ColinTaylor]

Hmm, tricky with stock firmware.

I assume you've disable NAT on the VPN link? What does the routing table look like on the server side (System Log - Routing Table)?

 

[maxbraketorque]

Before we continue with trying to configure OVPN to accomplish this, can I accomplish the same thing by using firewall-start IP tables on the client side which is a GT-AX6000 running Asusmerlin?