Per user routing rules

[rca]

This branch allows per-user routing such that access to hosts behind the VPN can be controlled on a per-user basis.

[netcraker01]

Hello im trying to improve this user routing and I get this error when a client is connecting:

`Failed to list table names in /proc/net/ip_tables_names: Permission denied

Traceback (most recent call last):

File "/usr/local/bin/client-connect", line 63, in

main()

File "/usr/local/bin/client-connect", line 59, in main

plan.execute()

File "/usr/lib/python3.7/site-packages/iptables/logic.py", line 41, in execute

tables = self.get_current_tables()

File "/usr/lib/python3.7/site-packages/iptables/logic.py", line 57, in get_current_tables

_, stdout, _ = run_command(command)

File "/usr/lib/python3.7/site-packages/iptables/logic.py", line 21, in run_command

raise CommandError('command={} failed with status={}'.format(command, status))

iptables.logic.CommandError: command=/sbin/iptables-save failed with status=1`

Thanks!

[rca]

Hey @netcraker01,

This is due to the openvpn server running as user nobody. I updated my /etc/openvpn/openvpn.conf like so:

# in order for the script to manage iptables, it cannot be nobody
#user nobody
#group nogroup

and script-security needs to be set in order to allow scripts to run:

# per-user route configurations
script-security 2
client-connect /usr/local/bin/client-connect

[netcraker01]

Hey @netcraker01,

This is due to the openvpn server running as user nobody. I updated my /etc/openvpn/openvpn.conf like so:

# in order for the script to manage iptables, it cannot be nobody
#user nobody
#group nogroup

and script-security needs to be set in order to allow scripts to run:

# per-user route configurations
script-security 2
client-connect /usr/local/bin/client-connect

Great now is up! Thank you !!,

Im trying to do something I have 3 clients 2 of them have same ip subnet (192.168.250.0) and the other one needs to conect to client 1 subnet or client 2 subnet by demand.
I hope that with this rules , I can create a pair of clients that only connect between they.
Now without this rules the last one in connect to the server is the only one avaiable to connect to the other client.
I will try more thanks again!