This question is a follow up on this question. We are currently working on the network design, nothing is implemented yet.
Our network will exist out of our own (internal) network and lot of customer networks connected via IPSec. Our employees need to have (direct/VPN) access to all customer networks with less effort as possible. They need to see web interfaces, ip cams, live streams and so on which are present in the networks of our customers.
We also want to give customer employees (VPN) access to their own network(s) but they are not permitted to see or access networks of other customers. Note that 1 customer can have multiple sites so multiple networks.
With the information of my previous question we think we need a subnet for each customer site and 1 for the VPN users of the customer. With this division we can manage the access to network via firewall rules.
E.g. request from our internal network or subnet where our employees are in can access all other subnets. Request from a customer user subnet (VPN) can only access subnets of their own sites.
Probably we will use OpenVPN (or similar) for VPN users (so our and customers employees). They get an (VPN) IP assigned by the VPN server so they are in the correct subnet.
Now we are thinking that it will be a lot of effort to manage VLAN's when we create one for each customer. We are also limited to the amount of VLAN's we can create. So we are curious if it is safe to set all the customer sites and VPN users in 1 VLAN, the "customer VLAN".
I mean, as long as the VPN user has an IP in the correct subnet, he can only access his own networks but i'm not sure if he can manipulate his (VPN) ip address so he is in antoher subnet. When this is possible he can access other networks by simply changing his VPN IP.
Is it possible that a user can change his VPN IP? and if it is, can we protect this in a scalable way with having less as possible management effort? E.g. only allow a specific IP range (e.g. 10.10.10.0/24 - 10.10.10.255/24) for a specific certificate?
I hope my question is clear like this as its pretty complicated for me to bring this on paper (or screen :P) Just to make it a bit more visual i added the scheme sketch bellow.