Maybe you want to access your home LAN while out, but you don't want your kid's phone to access your LAN. If he loses that phone and it isn't passworded, someone could (theoretically) find the phone, pull the certificate off, access your VPN, and then access files on your home LAN.
In this case, you'd like most users' traffic to be permitted to travel through the router on its way to the internet, but not to travel to your LAN; you want the same for traffic from your laptop, but you also want that traffic to be able to reach your LAN devices. Maybe your kid needs to work on his homework on his PC when you're at Grandma's, and you want to remote control his PC from your laptop using VNC.
I'm going to describe how to do this on an ASUS router running OpenVPN with 'Merlin' firmware. Merlin has some special capabilities which make this easier. Doing this on a Pi is similar, but some of the interfaces will have different names.
iptables is the command to add a firewall rule.
"–insert FORWARD" says to add a rule to the packet forwarding table at the beginning of the table.
-s and -d specify the source and destination subnets.
"-j DROP" says to drop any frames which match this rule.
To make this permanent, add the iptables command to a file on the router named /jffs/scripts/firewall-start.
You need to use the event 'firewall-start' and not 'openvpn-event', or else you can wind up with many, many copies of your rule in the table, if the VPN server gets stopped and started between reboots. *You need the first line in the file to be "#!/bin/sh".
"chmod ugo+x" the file and it will get executed when the VPN server starts (or stops).
See this for more info on event scripts.
The name you supplied becomes the X509 Common Name (CN) in your key. In this case, the common name will be "user-key03". Conveniently, when you look in ~/Packages/easy-rsa/keys_xxxxx, you'll see a file with a name like 'user-key-3.crt'. The file name of your certificate (less the ".crt") matches the CN inside the file.
That will assign Dad's laptop the IP address 10.8.0.50. When a client connects, OpenVPN matches the common name against files in the per-client config directory. If it finds a match, it loads that file as an extension of the OpenVPN file for the current client. Our command pushes the IP address to the client.
If no matching file is found, OpenVPN will try to use a default file called "DEFAULT", so you have a way to specify settings for users who do NOT match a per-client config.
Note: We're going to block access to all users and then grant access to Dad. An alternate approach would be to grant access to all users, and then block most users via a DEFAULT per-client config. I think it is safer to block by default, rather than by 'DEFAULT', in case something goes wrong with name matching or per-client config - you want the broken state to deny access, for security.
On the router, enable the "Manage Client-Specific Options" option under OpenVPN Server, and press Apply.
IMPORTANT: You must do this after you create the config in ccd1. When OpenVPN service is (re)started, Merlin copies from /jffs/configs/openvpn/ccd1 to /etc/openvpn/server1/ccd. jffs files are preserved across reboots. /etc/openvpn is where OpenVPN expects to find files, but it is on a RAM disk, so it vanishes after a reboot.
It won't work. In the first place, you clients can get to your LAN with or without that route. (I'm assuming that you enabled "Direct clients to redirect Internet traffic", which sends all client to the rouder.) In the second place, and more importantly, any route you can push (or not push), your users can defeat via the "route" command of their operating system.
Important principle: Locking people out is done with your firewall, not routes.
1st line = If a frame comes in on the VPN, from a 10.x.x.x address, destined for your LAN, drop it.
At this point, you should restart your router and confirm that these rules are in place via: "iptables -L FORWARD -v". Then test it with Dad's certificate and with someone else's certificate.
Via a postconf script, to 'sed' the config file.
It looks like you can assign static IP with an 'ifconfig-pool-persist' option, instead of per-client config (if the only per-client config you're doing is to set static IP). However, I've read of people having trouble getting it to work and, as I read things, the server can update this file, which would be a bad idea for your VPN security if it surprises you with an update.