topic Re: Is it possible to limit the VPN users' access by their public address? in General Topics

Is it possible to limit the VPN users' access by their public address?

Radmin_85 — Tue, 14 Nov 2017 15:44:07 GMT

Is it possible to limit the VPN users' access by their public address?

Re: Is it possible to limit the VPN users' access by their public address?

Mick_Ball — Tue, 14 Nov 2017 18:52:30 GMT

Looking forward to others suggestions as nothing comes to mind but have to ask why you would need to do this.

Re: Is it possible to limit the VPN users' access by their public address?

Raido_Rattameister — Tue, 14 Nov 2017 19:14:07 GMT

If you have users who VPN in and you know their public IP then sure you can allow vpn only from those IPs in Security Policy and block access to IP where vpn is terminated by all others. But what is the benefit?

Re: Is it possible to limit the VPN users' access by their public address?

Mick_Ball — Tue, 14 Nov 2017 19:21:40 GMT

@Raido_Rattameister. Are you saying that if you add a policy to block a certain ip or subnet on the external interface that it will overide the built in (i assume that terminology) rule for portal and gateway. I have no need to ever go there but just curious. I cannot think why you would need to do this!

Re: Is it possible to limit the VPN users' access by their public address?

reaper — Wed, 15 Nov 2017 09:17:52 GMT

both portal and gateway are 'accessed' through the untrust to untrust security policy, so if you want to block certain countries from being able to vpn in, you can use GeoIP (or the actual IP addresses) in a security policy to block those countries/IPs.

Once the vpn has been established, the traffic inside the tunnel will originate from the tunel interface, so all users will be identical from a 'source' perspective. you could still leverage UserID and group membership to provide different access privileges