I have been trying to setup a Astaro based firewall for a large client of mine and have problems with firewall rules relating to PPTP uesrs.
Background:
This clients has 2 types of PPTP users, 1 remote Internal staff, 2 external support staff and with Internal staff there are those that have limitted access and those that have unlimitted access, External staff all have limitted access.
Problem 1.
Create 2 PPTP users Fred and Jill both assigned dymanic ip address from PPTP pool. After creating the users I look in definitions section and find the following
Name Value Commment
Fred (PPTP user) inactive Autogenerated
Jill (PPTP user) inactive Autogenerated
All looks OK [:)]
Then I create the following rules:
source service action destination
-----------------------------------------------------------
Jill (PPTP user) CITRIX allow HSP61
Fred (PPTP users) ANY allow ANY
So Jill only gets Citrix access to 1 defined server Fred has unlimitted access.
After creating the rules if you "mouse over" the little icon to the right of the Source column the popup shows unresolved/inactive for the ip address (Fine)
Then user Fred connects and gets IP address 10.1.1.2, In the rules Fred's Source gets resolved to 10.1.1.2 .
Then Fred disconnects and jill connects, She gets the same IP address from the pool. 10.1.1.2, In the firewall Rules Jills Source IP is now set to 10.1.1.2, BUT Fred rules shows His IP address is still 10.1.1.2 even though he has disconnected and will remain that IP address till he connects again.
Going by what the rules report Jill (10.1.1.2 for this connection has full access!!!!!)
Problem 2.
Remote support staff.
Create the following PPTP Users XYZsupport1 fixed IP 10.1.1.50 and XYZsupport2 fixed IP 10.1.1.51
In Definitions create a Network Group called XYZSUPPORT and add XYZsupport1 and XYZsupport2
Then create a firewall rule like so
source service action destination
-----------------------------------------------------------
XYZSUPPORT Telnet allow someserver
When XZYsupport connects all works fine, if XYZsupport2 connects the firewall rules gets updated to his IP address and XYZsupport1 looses access
Since I have defined IP address for XYZsupport1 and 2 and then created a group containing both users the fire wall rule should read
source service action destination
-----------------------------------------------------------
10.1.1.50,10.1.1.51 Telnet allow someserver
But the firewall is still treating the PPTP has having dymanic IP address and who ever connects in last get access.
If I define a fixed IP address for a PPTP user then I expect the firewall to treate it has a fixed IP addess.
I know I can create a rule for each user to get around this, but my client has over 7000 Staff and 15 different external support companies accessing over 50 different servers
If I can not use Groups then it will be a real mess maintaining the rules.
Stephen
This thread was automatically locked due to age.