openvpn + ldap (auth, group) + custom firewall rules for some users/groups