Site-to-site OVPN - block specific IP range on server side from reaching client side?

[maxbraketorque]

I have been using firewall-start to block a specific IP range on the server side of my site-to-site OVPN connections from reaching the client side. Is there a way to implement this directly in OVPN, either on the server side or client side configurations?

 

[ColinTaylor]

Can you post your current firewall-start rules so we can fully understand what you're asking for?

 

[maxbraketorque]

Can you post your current firewall-start rules so we can fully understand what you're asking for?

This relates to the question I asked a few days about about using firewall-start on stock firmware. Asusmerlin no longer supports the AC68U, but Asus keeps cranking up updated stock firmwares for the AC68U. The only feature that I really use for Asusmerlin on my AC68U is firewall-start to block a specific range of IP addresses on the OVPN server side from reaching the client side. The firewall-start rule on the server side is:

iptables -I FORWARD -s 192.168.37.128/26 -d 192.168.38.0/24 -j DROP

37 is the server side (the AC68U), and 38 is the client side (another Asus router at a remote location). Can I accomplish the same thing using an OVPN configuration command?

 

[ColinTaylor]

Hmm, tricky with stock firmware.

I assume you've disable NAT on the VPN link? What does the routing table look like on the server side (System Log - Routing Table)?

 

[maxbraketorque]

Before we continue with trying to configure OVPN to accomplish this, can I accomplish the same thing by using firewall-start IP tables on the client side which is a GT-AX6000 running Asusmerlin?

 

[ColinTaylor]

Before we continue with trying to configure OVPN to accomplish this, can I accomplish the same thing by using firewall-start IP tables on the client side which is a GT-AX6000 running Asusmerlin?

That's why I asked you about your NAT setup (I'm not familiar with Asus LAN to LAN configurations). If connections are being masqueraded behind the VPN server address the client won't know how to differentiate the incoming connections.

To be clear, you're wanting to block connections initiated from the server side, not connections initiated from the client side?

 

[maxbraketorque]

I tried unsuccessfully to post the Routing Table from the server side. I'll try again.

I can and do routinely interact with devices across the VPN connection by using their local IP address.

My primary desire is to prevent devices in a specific IP range on the server side from participating in any interaction with all devices on the client side. For Asusmerlin on the server side (AC68U), I use:

iptables -I FORWARD -s 192.168.37.128/26 -d 192.168.38.0/24 -j DROP

Can I use this same command on the client side (GT-AX6000)? Or maybe this:

iptables -I INPUT -s 192.168.37.128/26 -j DROP ??