Client VPN EndPoints - Multiple Users Access

Question

If I want to allow multiple users to Connect through my Client Configuration (.ovpn) files. Do I need to share same Client Configuration (.ovpn) file with all users? So they can access resource on Cloud . If so, How can I provoke users which I don’t want to give access in later point of time?

In case I am doing it wrong or any alternate way, Please do tell. Thanks in advance.

Edit: Trying to set it up in AWS > VPC > Client VPN Endpoints.

Weary

Answer 1

You can create different certificates for each user.

In your *.ovpn, add the followings:

ca <CA File Name>
cert <Certificate File Name>
key <Private Key File Name>

And distribute these to the users: OVPN(modified), CA, CERT and KEY.

You can also revoke them.

Read this

• AWS Client VPN Mutual Authentication

Sloop

This should be the accepted answer. Our setup is like this and it works very well. One thing to keep mind: while creating the endpoint, the same certificate should be specified for both the server and the client. Afterward, generating client keys and certificates and preparing the individual .ovpn files as described in this answer should do the trick. Please see docs.aws.amazon.com/vpn/latest/clientvpn-admin/… Also for revoking access see this: docs.aws.amazon.com/vpn/latest/clientvpn-admin/… – Marquise

Answer 2

I think you are using an OpenVPN server for VPN connection,

If Yes!

While creating a VPN user in OpenVPN server you will get 4 files including certificate and .ovpn config file! if you want to share your credentials to others then you have to share all 4 files. but sharing same creds to others it will be problematic because concurrent two machines can't be connected with same user creds, you will face continuous disconnection problem.

The best practice is to create a new user and share.

Gold

Thanks. I am trying to achieve it in AWS > VPC > Client VPN Endpoints option. There is only one (.ovpn) file download option. – Weary

Answer 3

Only way to do so is with Active Directory integration while setting up Client VPN Endpoint.

Weary

This is not true. Please see my comment on the answer of @hyeonsoo. – Marquise