Restrict SSL VPN access to internal hosts

jmmacip · #1 (**permalink**) 07-03-2009, 12:21 PM

I'm trying to restrict access to a number og hosts in my internal network to a vpn user, i have auto packet filter off and created a specific filter, but the user has access to all the hsots in the internal network

SveN · #2 (**permalink**) 07-03-2009, 01:52 PM

Generate a DROP Rule after that Rule...

jmmacip · #3 (**permalink**) 07-03-2009, 03:38 PM

Quote:

Originally Posted by SveN

Generate a DROP Rule after that Rule...

What traffic should be dropped?
Thanks

BAlfson · #4 (**permalink**) 07-03-2009, 04:00 PM

jmmacip, do you want to limit all VPN users or just one? Which VPN are you using?

Cheers - Bob

xfiles · #5 (**permalink**) 07-03-2009, 10:36 PM

Quote:

Originally Posted by jmmacip

What traffic should be dropped?
Thanks

Hi,

The Rule should look like that:
from elmec
to ANY
Service ANY
DROP

and should be put directly AFTER your rule. To be 100% sure move your rule to the TOP (Rule 1) and the DROP rule after that (Rule 2).

If this works, then there probably is a rule in your rulebase that allows acces to your internal network for the whole SSLVPN-address-pool.

Kind Regards,

Matthias

BAlfson · #6 (**permalink**) 07-04-2009, 01:08 AM

Matthias has it right. But, if you had auto packet filter rule turned off in the VPN definition, your PF rule should have worked. The fact that it didn't indicates that you have another rule letting things through just as Matthias guessed.

The other thought I had when asking about the VPN was that for IPsec or SSL VPN, you could change 'Local networks' from 'Internal (Network)' to maquinas_elmec, and that would be all that was visible to the VPN.

Cheers - Bob

jmmacip · #7 (**permalink**) 07-07-2009, 11:55 AM

I have added a masquerade from SSL VPN to intenal network and now the packet filters work!