Index: npl/internetserver/openvpn_conf/openvpn_conf.build
===================================================================
--- npl/internetserver/openvpn_conf/openvpn_conf.build	(revision 75064bd64cb16e546529fb0021740952e3fa7079)
+++ npl/internetserver/openvpn_conf/openvpn_conf.build	(revision 1cb5ee67662cf2dcc32a9239bc4bd282acb00bde)
@@ -1,1 +1,1 @@
-6565
+6566
Index: npl/internetserver/openvpn_conf/openvpn_conf.md5
===================================================================
--- npl/internetserver/openvpn_conf/openvpn_conf.md5	(revision 75064bd64cb16e546529fb0021740952e3fa7079)
+++ npl/internetserver/openvpn_conf/openvpn_conf.md5	(revision 1cb5ee67662cf2dcc32a9239bc4bd282acb00bde)
@@ -1,11 +1,10 @@
-3bb0ddff2bba1afb30699c8181fa2287  ./openvpn_conf.pkg
+ef79757c53e0d2e0708525ee47d00123  ./openvpn_conf.pkg
 729b418d4c2197708760319d4097906e  ./openvpn_conf.SlackBuild
-c1e62f1b284422a04fa28a9f40d2b62e  ./openvpn_conf.SlackBuild.log.gz
+20fb700020946558a20824f87a9ae619  ./openvpn_conf.SlackBuild.log.gz
 638790d39f3f773301dd0c58a0db6008  ./root/etc/cron.monthly/openvpn_regen_crl
 02590f2d27b9254da5877e03719a9228  ./root/etc/firewall/services.openvpn
 5d08314120a94191e539c792b1c410a2  ./root/etc/openvpn/easyrsa
-e757a4246c98f98c150c7796e8c6f4fc  ./root/etc/openvpn/learn-address.sh
 d6cb374d0d7d5b7b87d74f9976362a70  ./root/etc/openvpn/openssl-1.0.cnf
-88937c4fed1e288bcedfc2975792c331  ./root/etc/openvpn/openvpn.conf
+636e64fe7182590b27f20607c584108d  ./root/etc/openvpn/openvpn.conf
 34ca6b140576e1502376f59dc2843365  ./root/etc/openvpn/openvpn_custom.conf.new
 d41d8cd98f00b204e9800998ecf8427e  ./root/etc/openvpn/openvpn_syn3.conf.new
@@ -16,4 +15,5 @@
 5f1d7122cb69dc05cda3c913f70f1cc1  ./root/etc/openvpn/syn3-genconfig
 aed23bf689b5b934959b28c45847b7ae  ./root/etc/openvpn/template.ovpn
+110d475c05ef7aecc70e3f70f4fa99d7  ./root/etc/openvpn/update-ipset.sh
 bdf6c4b1e71f502a768eda6e65e1ffbd  ./root/etc/openvpn/x509-types/ca
 84e917d7be5ee502148039694d5e579e  ./root/etc/openvpn/x509-types/client
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/learn-address.sh
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/learn-address.sh	(revision 75064bd64cb16e546529fb0021740952e3fa7079)
+++ 	(revision )
@@ -1,50 +1,0 @@
-#!/bin/bash
-
-# Openvpn iptables rules based on certificate name.
-# (C)2018 SYN-3 edwin@datux.nl
-
-OPERATION=$1
-IP=$2
-CN=$3
-
-CHAIN="openvpn_$IP"
-
-log()
-{
- logger -t learn-address "$1"
-}
-
-allow_tcp()
-{
-    log "Allowing tcp to $1 port $2"
-    iptables -I $CHAIN -d $1 -p tcp --dport $2 -jACCEPT
-}
-
-allow_udp()
-{
-    log "Allowing udp to $1 port $2"
-    iptables -I $CHAIN -d $1 -p udp --dport $2 -jACCEPT
-}
-
-# always cleanup first (in case of openvpn issues/restarts)
-log "Deleting $IP"
-iptables -D FORWARD -s $IP -j $CHAIN
-iptables -F $CHAIN
-iptables -X $CHAIN
-
-
-if [ "$OPERATION" == "add" ] || [ "$OPERATION" == "update" ]; then
-    # add chain
-    log "Adding $IP for $CN"
-    iptables -N $CHAIN
-    iptables -I FORWARD -s $IP -j $CHAIN
-
-    # add rules
-    if [ -e /etc/openvpn/rules/$CN ]; then
-        source /etc/openvpn/rules/$CN
-    fi
-
-fi
-
-
-exit 0
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn.conf
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn.conf	(revision 75064bd64cb16e546529fb0021740952e3fa7079)
+++ npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn.conf	(revision 1cb5ee67662cf2dcc32a9239bc4bd282acb00bde)
@@ -285,2 +285,6 @@
 # pam_ldap authentication (need to be member of group with uid 521)
 plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so "openvpn login USERNAME password PASSWORD"
+
+#learn ipsets to allow firewalling on openvpn certificate name
+learn-address /etc/openvpn/update-ipset.sh
+script-security 3
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/update-ipset.sh
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/update-ipset.sh	(revision 1cb5ee67662cf2dcc32a9239bc4bd282acb00bde)
+++ npl/internetserver/openvpn_conf/root/etc/openvpn/update-ipset.sh	(revision 1cb5ee67662cf2dcc32a9239bc4bd282acb00bde)
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# Openvpn iptables rules based on certificate name.
+# (C)2018 SYN-3 edwin@datux.nl
+
+OPERATION=$1
+IP=$2
+CN=$3
+
+
+log()
+{
+ logger -t openvpn-update-ipset "$1"
+}
+
+# always make sure the ip doesnt exist in other sets (in case of bugs/openvpn restarts)
+log "Deleting $IP from all ipsets"
+for SET in `ipset list -n|grep ^openvpn_cert_`; do ipset del $SET $IP; done    
+
+
+if [ "$OPERATION" == "add" ] || [ "$OPERATION" == "update" ]; then
+    # add chain
+    log "Adding $IP to ipset openvpn_cert_$CN"
+    ipset create openvpn_cert_$CN hash:ip
+    ipset add openvpn_cert_$CN $IP
+fi
+
+
+exit 0
