Set up an OpenVPN server with a firewall

Set up an OpenVPN server with a firewall that works as follows:

There must be administrators who are allowed access to all nodes.

There should be pools of different sites, and nodes included in them, each of which has its own VPN certificate and VPN address. Within these pools, access between nodes is open but can be restricted if needed.

There are also companies that can combine pools of several sites. In other cases, there is no direct connection between the pools of different sites.

Pools of organizations and their nodes should be pulled automatically from the JSON file, and the rights to the pool should be automatically issued to the node based on the contents of this file, while administrators, as mentioned, should always have access to all nodes.

JSON example:
{
"sitename_1": {
"nodelist": [
{
"hostname": "nodename-1",
"ipaddr": "10.8.2.103",
"friendlyname": "Nodename 1",
"site": "sitename_1",
"company": "Сompany 1",
"connected": 1,
"updated": "2022-08-07T09:58:19.116Z",
"created": "2020-11-16T22:19:06.169Z"
},
{
"hostname": "nodename-2",
"ipaddr": "10.8.2.104",
"friendlyname": "Nodename 2",
"site": "sitename_1",
"company": "Company 1",
"connected": 1,
"updated": "2022-08-07T09:58:19.116Z",
"created": "2020-11-16T22:19:06.169Z"
}
]
},
"sitename_2": {
"nodelist": [
{
"hostname": "nodename-3",
"ipaddr": "10.8.3.70",
"friendlyname": "Nodename 3",
"site": "sitename_2",
"company": "Сompany 1",
"connected": 1,
"updated": "2022-08-07T09:58:19.116Z",
"created": "2020-11-16T22:19:06.169Z"
},
{
"hostname": "nodename-4",
"ipaddr": "10.8.3.71",
"friendlyname": "Nodename 4",
"site": "sitename_2",
"company": "Сompany 1",
"connected": 1,
"updated": "2022-08-07T09:58:19.116Z",
"created": "2020-11-16T22:19:06.169Z"
},
{
"hostname": "nodename-5",
"ipaddr": "10.8.3.72",
"friendlyname": "Nodename 5",
"site": "sitename_2",
"company": "Сompany 1",
"connected": 1,
"updated": "2022-08-07T09:58:19.116Z",
"created": "2020-11-16T22:19:06.169Z"
}
]
},
"sitename_3": {
"nodelist": [
{
"hostname": "nodename-6",
"ipaddr": "10.8.4.20",
"friendlyname": "Nodename 6",
"site": "sitename_3",
"company": "Сompany 2",
"connected": 1,
"updated": "2022-08-07T09:58:19.116Z",
"created": "2020-11-16T22:19:06.169Z"
},
{
"hostname": "nodename-7",
"ipaddr": "10.8.4.21",
"friendlyname": "Nodename 7",
"site": "sitename_3",
"company": "Сompany 2",
"connected": 1,
"updated": "2022-08-07T09:58:19.116Z",
"created": "2020-11-16T22:19:06.169Z"
}
]
}
}