#Open vpn server mac for mac#
#Open vpn server mac install#
#Open vpn server mac software#

Also this would only work with the OpenVPN Connect Client, and not other OpenVPN client software, which may limit your options.

#Open vpn server mac for mac#

So if you were to add this function you would have to take the sample post_auth script for MAC address filtering, and then add extra code to it to perform the extra other checks.

However you can only load one post_auth script at a time.

#Open vpn server mac software#

Using post_auth script it is also possible to get version numbers for software products installed on Windows and Macintosh devices, and to block/allow based on that information. So while I understand that yes, you can spoof a MAC address, without knowing which address to spoof, it's going to be yet another roadblock to overcome. You're just adding another protection factor, which is a good thing. but then again you can also guess passwords. It just adds another layer of protection, and I mean sure, you can spoof it.

They would need things like the certificate, username, and password, and optionally a 2FA code, and on top of that the right MAC address. But it would require whoever tries to get in with a spoofed address to try over and over and over and over. Regarding spoofing, yes, it is possible to spoof it. Further details are explained in the documentation of that script. If you open a support ticket by going to then 'sign in' at the top, and once signed in, click 'support' at the top, and request information about a sample post_auth MAC address filter script, the support personnel there can provide you with a copy of that file with sample script, which you can implement to enable MAC address filtering. That is because OpenVPN clients can report certain details like MAC address and OpenVPN version number during the initial steps when making a VPN tunnel connection, and the Access Server can perform extra checks on this information before allowing the connection to fully establish. We have shared that MAC address can easily be spoofed and it operates only Layer 2 addressing (VPN is operating on Layer 3 addressing).ĭoes anyone know if there is any viable method on OpenVPN to restrict client to a specific set of device? Or, does OpenVPN has any check on the client to make sure it met certain criteria? For example, on Palo Alto Network's GlobalProtect, it has a feature called Host Information Profile (HIP) that will checks the client to make sure it has all the specific criteria:Īctually, it operates just fine on Layer 3 as well with the OpenVPN Access Server product. The auditors replied that other companies met this requirement by using MAC address filtering.

#Open vpn server mac install#

We have responded that this requirement is not practical because users can install the same client and configuration file to access the server. not allowing OpenVPN client access on a personal device). We have a requirement from the ISO auditors to restrict the OpenVPN client access to a corporate device (i.e.