pfSense

+1
some could say that it can be done using more than one openvpn server instances with different client ip settings and different firewall rules applying at each. But the idea of having firewall rules grouped and applied in a per user group basis seems to be very helpful (despite of the fact that some of it can be approached using Aliases).
This feature also seems to have the same goal with #3156

The user based rules are supported if they come from radius.

Locally to pfSense they still need to be implemented.

+1
I even have that in my local ZyXEL router... it's a must have do define firewall rules by LDAP / local groups and users.

Ermal Luçi wrote:

The user based rules are supported if they come from radius.

Locally to pfSense they still need to be implemented.

Can you give me a brief description of where I need to look to set up radius user based rules today?

Jim Pingle wrote:

This has been in place since pfSense 2.1. It uses the same syntax as cisco inacl/outacl, for example "permit tcp from any to any", and if you use subnet masks they need to be wildcard style.

What exactly has been in place since 2.1? I have never seen anything user-based in the firewall section.

https://docs.netgate.com/pfsense/en/latest/book/openvpn/controlling-client-parameters-via-radius.html

It has also seen some recent fixes and has some pending enhancements: #9206 #10454

I think it must be something like https://conexti.com.br/userauth/
I personally need such features for provide network (vlan) access to my users by their groups (for OpenVPN).
For example:
Group A -> access to VLAN 10
Group B -> access to VLAN 11
I add user to groups A and B in LDAP, and he automatically obtain access to VLANs 10 and 11.
For now I must provide static IP for every single user and create firewall rules for each IP individually.

see also #8836