OpenVPN Access Control Behavior - Observation and Suggestion

Feedback
1

I’ve noticed some behavior in the OpenVPN app integration that might benefit from clearer documentation or UI explanation.

Current Behavior:

  • When a user is added to the ‘vpn’ group, they can download their OpenVPN profile
  • If the user is later removed from the ‘vpn’ group:
    1. They can still connect to the VPN using their previously downloaded profile
    2. They are prevented from downloading their profile again

UI Description vs. Actual Behavior:
The Users and Groups app currently describes the ‘vpn’ group permission as “Connect to VPN services (vpn)”. This description could be misleading because:

  • It suggests that removing the group permission would prevent VPN connections
  • In reality, it only controls profile download access, not connection capability

Suggestion:
I believe this could be made clearer in one (or both) of these ways:

  1. Update the UI description to something like: “Download VPN connection profiles (vpn)”
  2. Add a note in the documentation explaining that removing VPN group access only prevents profile downloads, not existing connections

This clarification would help administrators better understand the security implications of VPN access management in FreedomBox.

Has anyone else noticed this? What are your thoughts on making this clearer for users?

1 Like