IPSec VPN restrict user access to LAN resources

Hi Downsideup : Yes with the help of firewall rule it is possible. You may set up 1 rule to allow traffic which covers that user and that server IP and create another rule exactly below in position to this allow rule to drop rest of the user traffic from VPN to that server IP with rule action drop.

Reference snapshot from local XG for rule configuration.

Allowed Rule for test user to have access of DMZ server:



Drop rule for other users from VPN to DMZ for same DMZ server.



Rule view from "Firewall rules" page:



Please change zone, user and IP in above settings as per your requirement. 

Thank you Vishal, do I need the second rule if I only allow the connection to specified users\groups in the first rule?

Hi Downsideup : The firewall rule matches the traffic in top to bottom order, if no any other matching rule found for other users after configuring allow rule for specific user then drop rule not needed, but if traffic will getting any matching rule in top to bottom approach, then it will allow traffic via that rule and in that case you may need create drop rule as per above.

Thank you again!!