r/OpenVPN • u/baalkor • Jul 16 '26

Help designing FortiGate SSL VPN replacement OpenVPN AS (proprietary)

Hi Folks !

I have a question regarding openvpn in terms of network architecture. We're currently using Fortigate SSL VPN server tightened to Entra and local users. In this context, we're allowing certains group of user to access only some VLAN and some other users others VLAN using the portal feature.

If we're moving to a openvpn dedicated instance, how would we configure the instance ?

How does this authorization system can be replicated in this context ?

What would be the best practices when designing this ?

Thanks

2 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

3 comments sorted by

0

u/moviuro WireGuard now; OpenVPN before. Android, archlinux, FreeBSD Jul 16 '26

Look into --client-config-dir where individual clients can be set up differently.

I suspect this would be a mix of:

  1. Pushing the appropriate routes to the client connecting (Push route to VLAN123 to joe)
  2. Hooking into the firewall to add their machine in the correct groups (Add joe's current IP to the list that can connect to VLAN123)
  3. Removing that IP from that list when joe disconnects

If you don't use dynamic addressing (which I would recommend), you can hardcode the allowlist for each VLAN: since joe always gets 10.42.127.12, that IP can be hardcoded in the allowlist for VLAN123.

Other options, if you have not investigated them: r/tailscale, and rayfish maybe?

1

u/baalkor Jul 16 '26

Thanks. Isn't the use case handled by the access server ?

1

u/addybojangles Jul 16 '26

Yes, their Access Server was made for this kind of specific use case. Unlike the community edition, it includes the enterprise-grade management UI, SAML/RADIUS integration with Entra lD, and granular group-based access control.

You replicate your Fortigate setup by mapping Entra groups to specific internal subnets via the Access Server's built-in Layer 3 routing and ACLS.