Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 40 subscribers
  • Views 1401 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

External Contractor access to Azure via our SSL VPN, with Mac OS tossed in...

WABGOR_DAVE

Hello all,

We have some external contractors that require access to our Azure network instance, and instead of whitelisting their own public IPs, we want them to come through our firewall (XGS 136, latest SFOS, SSL VPN set to act as gateway mode), so that we can log access and only have to whitelist our company IP range.  The remote "internal" users are working as intended; however, the contractors are able to connect to our FW, using Tunnelblick, because they are Mac users, and can't go anywhere.

I have 3 Groups/Profiles of Users created in the FW for SSL VPN: 

  1. Regular employees needing remote access to internal servers only - Configured as split
  2. Regular remote users that need access to internal and Azure instances - Gateway (standard/unified)
  3. External Contractors - Gateway (standard/unified) that should only be able to access our Azure instances

The DNS configuration for our SSL VPN is set for internal servers only (added to DNS for group 1, and only DNS available when using SSL VPN for 2 and 3).

There are a couple of issues with group 3:

First Issue: TunnelBlick Warning: DNS server address 192.168.1.1 is not a public IP address and is not being routed through the VPN

This makes sense as the only DNS available in Gateway mode is our internal DNS servers, sitting on our LAN

Second Issue: Users can't connect to Azure instance nor the internet in general (related to Issue 1...)

Would adding just the DNS server host as a permitted Network Resource, correct 1 and 2, without exposing anything else on our internal network? Do we even need to have #Port4 interface as permitted, if access to the DNS server is provided?


Simple Diagram for the visualists, like me (Orange items stop at the FW, Green items are working as intended).



This thread was automatically locked due to age.
  • 0

    Hello  ,

    Thank you for reaching out the community, for the TunnelBlick Warning please refer - https://groups.google.com/g/tunnelblick-discuss/c/lPrltf1UrTw/m/6ZIKXVM0BQAJ

    And for the second issue, under the permitted network - select network resources if you want remote users to access these internal resources. If you turn on the default gateway setting, the firewall's rules and protection policies apply to the remote users' internet traffic. So, configure a firewall rule with the source zone set to VPN and the destination zone set to Any to allow traffic to the internet and the permitted resources. You can also set the source networks to the system hosts ##ALL_SSLVPN_RW and ##ALL_SSLVPN_RW6.

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 

    Log a Support Case | Sophos Service Guide
    Best Practices – Support Case


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Vivek Jagad

    Hey ,

    For the tunnelblick it does seem to re-enforce what I thought to be the reason why.  I assume, from what I have found (or rather not found), there is no way to have a separate/multiple SSL VPN networks/configurations?  I would love to be able to have different profiles and networks for different user groups.  In the linked google group, it mentions setting the VPN server as the DNS server; what implications would that have on the other users that are working?

    I understand the gateway function / limitations, and have a working rule set for all other SSL VPN users except the external contractors.  They can get as far as the firewall, they just can't go anywhere else, as the SSL VPN DNS servers are also internal and that network is what I'm trying to keep them out of. I know we can push out / configure their profile to use an external DNS server, but that will be A) a pain to remember to add every time a new contractor is added, and B) cause a "DNS leak" or even an ARP poisoning if I'm reading the tunnelblick advice correctly.

  • +1

    I have fixed this, by adding the WAN port and the IP Host of the Internal DNS server.

Unfiltered HTML