Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 8606 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

forbid Access from / for a specific Network / Subnet

Andreas Czech

Hi Guys,

these Time I've a really strange Situation and hope for your Help / a good Idea.

Situation:

I've a Subnet which should only be able to connect using VPN. So I created the VPN by Remote Access SSL and disabled the Firewall Rule (DNS, Websurfing). I tried to connect to the Internet and to my Surprise it still works. Then I tried to disable this Network completely and disabled (for testing) the Masquerading Rule, but it still works (Internet Access). And now I tried to create an Network Rule which forbids all Traffic from this Subnet and maybe you guess that it still works -> confused.

Maybe someone has an Idea of what goes wrong here?

No Masquerading Rule, nothing that allows the Traffic through the Firewall and although a Rule to block all Network in the Firewall -> but still Internet-Access. I'm confused



This thread was automatically locked due to age.
Parents
  • 0

    On your VPN Profile, you configure an Allowed Networks list.   Traffic for those destinations go through the VPN tunnel, and everything else is handled by the PC's network connection.   I think this is the reason for your symptoms.  It is also probably all that needs to be done for your scenario.   This is called split-tunnel VPN.

    An alternative is for the VPN Profile to allow all networks, to create a full-tunnel VPN .   This forces all network traffic to flow to the UTM, which means that you need to have configuration rules to block whatever is needed.   UTM has a unique architecture:  traffic which goes through a proxy will bypass the firewall rules.   That is why this configuration is more complicated.

    To illustrate:

    Assume you  SSL VPN traffic arrives on 10.10.10./24nd is only supposed to have access to 192.168.10.0/24, but your entire network uses many subnets within 192.168.0.0/16.  VPN access to Internet should also be blocked.

    Firewall Rules

    1. ALLOW traffic from 10.10.10.0/24 to 192.168.10.0/24 port ANY.
    2. BLOCK traffic from 10.10.10.0/24 to ANY port ANY. 

    Web Proxy, FTP Proxy, POP3 proxy, etc

    • Ensure that 10.10.10.0/24 is not on any Filter Profile allow network range, OR
    • Create a Filter Profile for 10.10.10.0/24 which is linked to a policy and a Filter Action that blocks everything, then give it precedence over any filter profile that includes 10.10.10.0/24 in a larger network range.

    WAF

    • Use Access Control on Site Path Routing to prevent access from the VPN subnet
  • 0 in reply to DouglasFoster

    DouglasFoster said:
    On your VPN Profile, you configure an Allowed Networks list.   Traffic for those destinations go through the VPN tunnel, and everything else is handled by the PC's network connection.   I think this is the reason for your symptoms

    I disabled and as nothing happened deleted the VPN Profile. Still nothing (Access from this Subnet to the Internet).

    still no Effect. :-( I rebooted the UTM -> still no Effect.

    I created a Filewall-Rule to block all Traffic from this Subnet -> no Effect

    I disabled the Masquerading for this Subnet -> no Effect

     

    thanks for your Suggestions on the VPN, but I want to solve this first.

Reply
  • 0 in reply to DouglasFoster

    DouglasFoster said:
    On your VPN Profile, you configure an Allowed Networks list.   Traffic for those destinations go through the VPN tunnel, and everything else is handled by the PC's network connection.   I think this is the reason for your symptoms

    I disabled and as nothing happened deleted the VPN Profile. Still nothing (Access from this Subnet to the Internet).

    still no Effect. :-( I rebooted the UTM -> still no Effect.

    I created a Filewall-Rule to block all Traffic from this Subnet -> no Effect

    I disabled the Masquerading for this Subnet -> no Effect

     

    thanks for your Suggestions on the VPN, but I want to solve this first.

Children