SSL site-to-site connection: block all but one specific client

Hi, Gerd, and welcome to the UTM Community!

The problem is that you now have a tunnel with:

[Home Network] <---> [Office Network]

The most elegant solution is to change the definition in both devices to:

[Some Home IPs] <---> [Office Network]

Is that possible?

Cheers - Bob

Hi Bob, and thank you for your answer!

At the [Home Network] there is no Sophos UTM, there is a dd-wrt router with a little complicated/scripted setup to establish the VPN connection via a standard openvpnclient and I would like to not touch this setup.

But I think there should be an easier solution on the  [Office Network] side only, because only one office-computer (mine) should be able to connect to [Home Network]. All other computers should not have access at all.

Some firewall rules like:

- traffic from [Office Network] to [Home Network] not allowed
- but if connection _initiated_ from [Home Network] , then allow traffic back from [Office Network] to [Home Network]
- and if connection initiated from IP 10.0.0.123 (my office-computer), then traffic from [Office Network] to [Home Network] allowed, also

Any ideas?

Best regards,
Gerd

That's a little different from what I first understood, Gerd.  Let me say that in my own words to be sure I understand now:

• Traffic to any office IP from the home is allowed.
• Only traffic from your office IP (.123) is allowed to any IP in your home.

Is that it?  If so, then uncheck 'Automatic firewall rules' and create the following firewall rules:

• {Home Network} -> Any -> {Office Network} : Allow
• {10.0.0.123} -> Any -> {Home Network} : Allow

All other traffic will be dropped by default and all response traffic will be allowed by conntrack because the request was allowed.

Cheers - Bob

Hi,

ok now a little problem occurred:
With the rules from above the SSL-VPN connection is still active/alive but the {Home Network} clients are no longer allowed to connect to {Office Network} resources, I can see the drop of ICMPs in UTMs firewall log.

If I do the following:

• {Home Network} -> Any -> {Office Network} : Allow
• AND additionally: {SSL-VPN Network} -> Any -> {Office Network} : Allow
• {10.0.0.123} -> Any -> {Home Network} : Allow

the connection is working again, but:

• {10.0.0.123} can ping from {Office Network} to {Home Network}
• {10.0.0.123} can establish a remotedesktop connection from {Office Network} to {Home Network}
• {10.0.0.XXX} cannot ping to {Home Network} clients but can establish a remotedesktop connection to {Home Network} clients?

What's still wrong?

Best regards,
Gerd

Pinging is regulated on the 'ICMP' tab of 'Firewall', Gerd.  The "Any" Service only includes TCP and UDP, not ICMP or other IP protocols.  If you want to allow pinging selectively, you must disable it on the 'ICMP' tab and create firewall rules using the "Ping" Service.  This is also required for inbound VPN connections to be able to ping your home devices.

Cheers - Bob