OpenVPN Access Server Creating Groups & Users

Question

I have created an OpenVPN on aws via cloudformations - all working as expected except bootstrapping.

on user data i have entered some comands to do some of changes e,g, enabling googleauth etc.

in addition to this I also would like to create a group - and then create users and assign to this group, onnce those are done than i want to create a role to the group so it does the split tunnelling e.g. not all traffic go through the internet - so i want only want to redirect couple IP to this group

I am stack at the moment by creating groups - I have found the command https://evanhoffman.com/2014/07/22/openvpn-cli-cheat-sheet/ and enter on boot strap but i cant find anything for creating a group creating an Access control which allow access to netwokr serices to internet.

so anyone has any expirence with openvpn access server CLI? how to create groups and assgin users to this group for split tunneling?

Answer 1

I too ran into a scenario where I wanted to create a group from a script for googleauth. I found this post: https://forums.openvpn.net/viewtopic.php?t=21680#p61381

I have expanded on the solution provided, with explanations here: https://forums.openvpn.net/viewtopic.php?t=21680#p72243

Quick reference:

cd /usr/local/openvpn_as/scripts # Create the group named "googleauth" using sacli ./sacli --user googleauth --key type --value group UserPropPut # Configure the group properties to require google_auth ./confdba --userdb --prof googleauth --mod --key c2s_dest_s --value false ./confdba --userdb --prof googleauth --mod --key c2s_dest_v --value false ./confdba --userdb --prof googleauth --mod --key group_declare --value true ./confdba --userdb --prof googleauth --mod --key prop_autologin --value false ./confdba --userdb --prof googleauth --mod --key prop_deny --value false ./confdba --userdb --prof googleauth --mod --key prop_google_auth --value true ./confdba --userdb --prof googleauth --mod --key prop_superuser --value false ./confdba --userdb --prof googleauth --mod --key type --value group # Reload config with sacli ./sacli start 

Answer 2

./sacli --user groupname --key prop_reroute_gw_override --value option UserPropPut

options for value

dns_only: route it to their gateway however, DNS lookup must through the VPN server.

global : follow the default combination of

 1) vpn.client.routing.reroute_gw 2) vpn.client.routing.reroute_dns 

disable: do not override.