Setup: Server to access all clients, but clients no access

[Petrol]

Under Linux you can achieve this by creating a local bridge, you can take a look to this blog (it's not mine) http://blog.lincoln.hk/blog/2013/05/17/ ... al-bridge/) to see how to create a local bridge and a DHCP server.

Than you can play with you firewall to drop any packet that wan't to go from one sql server to another.

You can also setup your dhcp server not to push a default gateway so the traffic from you sql server won't be redirected into the vpn (dhcp-option 3 disables the default gateway. dhcp-option,6 disable the dns in the dnsmasq.conf).

I hope I helped, maybe there is a easier way to achieve what you want, I don't know.

[thisjun]

I think "Privacy Filter Mode policy" and PC-to-PC VPN is good for your intention.
http://www.softether.org/4-docs/1-manua ... y_Policies
http://www.softether.org/4-docs/1-manua ... -to-PC_VPN