next »

[jerem87]

Good evening,

I am sorry for the translation in English, I am French.

Is it possible to indicate to PfSense a host rather than a distant address of network? Would I wish that the VPN customer simply allow to reach to a distant host and not a whole distant network?

Thank you very much.

Jérémie.

[Cry Havok]

Not in 1.2.  I believe that firewalling on OpenVPN doesn't come in until 2.0, which is still in Alpha.

[jimp]

There is some support for filtering OpenVPN in 1.2.3, but it's not very elegant.

You can add an OpenVPN tunnel, bring it up, then assign the resulting tunx (likely tun0) interface as an opt interface. You can then enable that opt interface, name it OpenVPN, give it a (bogus?) ip address, and you'll get a tab on the firewall rules where you can control access.

What I'm not so sure of is how reliable this is. In my testing, after making changes in OpenVPN which made tun0 leave and come back, I had to edit/save the rules again for things to work as expected. I may have misconfigured something along the way though.