[PR #1505] [MERGED] Add configurable VPN access policies #450

New Issue

2026-11-11T16:41:57+01:00

Alvin-Zilverstand commented

2026-11-11 16:41:57 +01:00

📋 Pull Request Information

Original PR: https://github.com/angristan/openvpn-install/pull/1505
Author: @angristan
Created: 8/2/2026
Status: ✅ Merged
Merged: 8/2/2026
Merged by: @angristan

Base: master ← Head: feature/routing-access-options

📝 Commits (7)

7357079 Add configurable VPN access policies
1a0fa9c Update VPN access policy diagram
3274915 Fix shell formatting
5f69dda Add packet-level access policy tests
8c40bc9 Fix firewalld forwarding policies
0471828 Suggest local networks interactively
9058f91 Avoid DNSSEC flake in connectivity test

📊 Changes

11 files changed (+1495 additions, -473 deletions)

View changed files

📝 .github/workflows/docker-test.yml (+84 -5)
📝 FAQ.md (+32 -67)
📝 README.md (+23 -3)
📝 docker-compose.yml (+4 -0)
📝 openvpn-install.sh (+871 -281)
📝 test/Dockerfile.client (+2 -1)
📝 test/Dockerfile.server (+3 -2)
📝 test/client-entrypoint.sh (+102 -9)
➕ test/local-network-detection.sh (+92 -0)
➕ test/policy-peer-entrypoint.sh (+35 -0)
📝 test/server-entrypoint.sh (+247 -105)

📄 Description

Summary

add independent install options for internet routing, client-to-client access, and explicit server-side networks
enforce the selected policy across firewalld, nftables, and iptables, including DCO traffic
use destination-scoped NAT for home LAN access and preserve client routes and DNS in split-tunnel mode
document the new defaults and add focused Docker policy coverage

Defaults remain internet access enabled, client-to-client access disabled, and server-side network access disabled.

Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213 #147

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/angristan/openvpn-install/pull/1505 **Author:** [@angristan](https://github.com/angristan) **Created:** 8/2/2026 **Status:** ✅ Merged **Merged:** 8/2/2026 **Merged by:** [@angristan](https://github.com/angristan) **Base:** `master` ← **Head:** `feature/routing-access-options` --- ### 📝 Commits (7) - [`7357079`](https://github.com/angristan/openvpn-install/commit/7357079bb9ee1205a4265b84fc6b8d4efca2d7f5) Add configurable VPN access policies - [`1a0fa9c`](https://github.com/angristan/openvpn-install/commit/1a0fa9c9b0b2f818de4c143eb350274971afe3c8) Update VPN access policy diagram - [`3274915`](https://github.com/angristan/openvpn-install/commit/3274915ac736605733b733780c0d3d9deaf2cbb6) Fix shell formatting - [`5f69dda`](https://github.com/angristan/openvpn-install/commit/5f69ddadd881718bfe5ecc36dd89fe7a962b4e6d) Add packet-level access policy tests - [`8c40bc9`](https://github.com/angristan/openvpn-install/commit/8c40bc9b4da80f5bbb8ada23b58c70541708c661) Fix firewalld forwarding policies - [`0471828`](https://github.com/angristan/openvpn-install/commit/047182884bb0973d4e6c204a2bb10acbae476c0e) Suggest local networks interactively - [`9058f91`](https://github.com/angristan/openvpn-install/commit/9058f913b7a875b6065079efe9f0b2b511bf4e6f) Avoid DNSSEC flake in connectivity test ### 📊 Changes **11 files changed** (+1495 additions, -473 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/docker-test.yml` (+84 -5) 📝 `FAQ.md` (+32 -67) 📝 `README.md` (+23 -3) 📝 `docker-compose.yml` (+4 -0) 📝 `openvpn-install.sh` (+871 -281) 📝 `test/Dockerfile.client` (+2 -1) 📝 `test/Dockerfile.server` (+3 -2) 📝 `test/client-entrypoint.sh` (+102 -9) ➕ `test/local-network-detection.sh` (+92 -0) ➕ `test/policy-peer-entrypoint.sh` (+35 -0) 📝 `test/server-entrypoint.sh` (+247 -105) </details> ### 📄 Description ## Summary - add independent install options for internet routing, client-to-client access, and explicit server-side networks - enforce the selected policy across firewalld, nftables, and iptables, including DCO traffic - use destination-scoped NAT for home LAN access and preserve client routes and DNS in split-tunnel mode - document the new defaults and add focused Docker policy coverage Defaults remain internet access enabled, client-to-client access disabled, and server-side network access disabled. Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213 #147 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

Alvin-Zilverstand added the pull-request label 2026-11-11 16:41:57 +01:00

Alvin-Zilverstand closed this issue

2026-11-11 16:41:57 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/openvpn-install#450