Hello.

I have some linux devices (currently Raspberry Pis, in future some more advanced embedded linux boards) and I am going to put them in some location with internet access through NAT.

I need to be able to connect (SSH is enough) to any of this machine, but due to to security reasons, linux boards cannot see each other - only me/server (I can set up an online server with external IP) and must authenticate (board 1 cannot spoof as board 2).

Could someone recommend me some solution/sofrware which could to that?

From what I have found on this forum - VPN (like OpenVPN) is a possible solution, but is it possible to setup this way:
- every machine has own ID/key/password/certificate and IP (no possibility of changing IP, machine with invalid IP will be dropped by server)
- groups (i.e. ip ranges): servers, supervisors, clients; clients can only access servers, and cannot access each other, supervisors and servers can access whole network.

Any other solutions? For example client connects to server and server (on supervisor request) can open a tunnel within this connection.

setting up /etc/host.allow to be the router will probably work.

therefore anyone from the outside world would be able to ssh in but anyone inside of your network will be denied.