SSL VPN

Indicate the IP address that users must use to reach the firewall to set up SSL VPN tunnels.

• If you enter an IP address, it must be public, and therefore accessible over the Internet,

• If you enter an FQDN (e.g., ssl.company.tld), it must be declared on the DNS servers that the client device uses when it is outside the corporate network. If you have a dynamic public IP address, you can use the services of a provider such as DynDNS or No-IP. In this case, configure this FQDN firewall in the Dynamic DNS module.

Select the object representing the networks or hosts that will be reached through the VPN tunnel. This object makes it possible to automatically set on the client device the routes needed to reach resources that can be accessed via the VPN.

Filter rules (in the Filter - NAT module) will be necessary to more granularly allow or prohibit traffic between remote clients and internal resources.

Select the object corresponding to the network that will be assigned to VPN clients. The network mask must not be smaller than /28. You can assign a network to VPN clients in UDP, and another network to VPN clients in TCP, but they must both be different. The VPN client will always choose the UDP network first to ensure better performance.

Choosing the network or sub-networks:

• Choose a network dedicated to SSL VPN clients that does not belong to any existing internal networks, or declared by a static route on the firewall. Since the interface used for the SSL VPN is protected, the firewall would then detect an IP spoofing attempt and block the corresponding traffic,

• Choose seldom-used sub-networks (e.g., 10.60.77.0.24/) to prevent routing conflicts on client devices during the connection to the VPN. Many filtered Internet access networks (public Wi-Fi, hotels, etc) or private local networks already use the first few reserved address ranges.

The maximum number of simultaneous tunnels allowed appears automatically. This corresponds to the minimum value between the maximum number of tunnels allowed on the SNS firewall and the number of sub-networks available for VPN clients. The number of sub-networks represents a quarter of the number of IP addresses minus 2. An SSL VPN tunnel consumes four IP addresses, but the server reserves 2 sub-network for its own use.

The SSL VPN service listens on all of the SNS firewall's IP addresses by default. You can select the object representing the IP address used for setting up SSL VPN tunnels (UDP), especially when:

• The IP address used for setting up the SSL VPN tunnels (UDP) is not the main IP address of the external interface.

• The IP address used for setting up the SSL VPN tunnels (UDP) belongs to an external interface that is not linked to the default gateway of the firewall.

The listening ports of the SSL VPN service can be changed to UDP and TCP, Some ports are reserved for the SNS firewall’s internal use only and cannot be selected. If you change any of the default ports, the SSL VPN could become inaccessible from networks (hotels or public WiFi) on which Internet access is filtered.

Port 443 is the only port below 1024 that can be used.

Select a script that the VPN client will run when the VPN tunnel is opened. Example of a script that makes it possible to connect the Z: network drive to the shared network:

NET USE Z: \\myserver\myshare

Select a script that the VPN client will run when the VPN tunnel is closed. Example of a script that makes it possible to disconnect the Z: network drive from a shared network:

NET USE Z: /delete

Select the desired certificate. The icon indicates certificates with a TPM-protected private key. For more information on the TPM, see the section Trusted Platform Module.