Block internet usage from SSL VPN users

Question

Hello, 
 Please help me! 
 I'm using Sophos SG210. I have a number of users connecting via SSL VPN. I want to prevent them having internet access on my end. I just want to let them access my internal network. 
 I tried creating a firewall rule but it can still use the Internet.

kerobra · Accepted Answer

Not exactly but it goes in that direction. 
 The IP of the client's local network adapter itself doesn't change. When Sophos SSLVPN is installed it creates a second, virtual network adapter that is only used when you are logged in to SSLVPN. When you are logged in that adapter gets an IP address, gateway, and (if configured) DNS or WINS settings from the firewall. 
 For the firewall ruleset only this virtual IP address is of interest. 
 
 Your client PC normally has an IP address and a default gateway, where all traffic that does not point to the same local network is sent to. When you are connected to SSLVPN the routing of your client is changed. All hosts/networks, that were configured in the firewall's RAS profile will get an extra routing entry, which points to a virtual address of the firewall. 
 You can review this (on windows) by running cmd and typing the command "route print" before and after connecting to SSLVPN.

FormerMember · Answer

Hi Phan Tuấn , 
 Thank you for reaching out to Sophos Community. 
 Add required internal networks in SSL remote access profile.

Block internet usage from SSL VPN users

Top Replies