Clientless VPN

Clientless VPN setup and settings

Last adaptation to the version: 14.2.0 (07.2026)

New:

Beta For participants on the Beta Channel only:

VPN hosts can be copied
Extended search function available

Additionally: display of the security setting used in the overview
When configuring a connection, user groups can be selected directly and displayed in the table 14.1.1
The overview table of the CVPN connections has been extended with numerous pieces of information 14.1.1
The selectable video resolutions have been increased 14.1.1

notempty

This article refers to a Beta version

14.1.2 14.0.9.2 12.7.0 12.2.5 11.7.6 11.6.11

Introduction

Overview of the clientless VPN connections

notempty

Neu ab v14.1.1: Zahlreiche zusätzliche Informationen ergänzt

Clientless VPN provides the ability to connect to an RDP or VNC server on the corporate network via the browser. Users log in to the user interface and are then given the option to connect with a designated server. For this to work, the browser must have HTML5, Java or similar is not necessary.

The overview displays numerous pieces of information:

Server name
Type
IP address
Port
Domain
User name
Video mode

Security

TLS Indication of the security
RDP (deprecared) Warning for outdated protocols or unencrypted connections
User groups

CVPN-User Assigned group with Clientless VPN permission
CVPN-User Assigned group without Clientless VPN permission

notempty

New as of v14.2.0

Ein Klick auf die Schaltfläche öffnet die erweiterte Suche

hide

Klicken für dauerhafte Anzeige

Erweiterte Suche
Spalte	Dienst	Name der Spalte auswählen. Die Auswahl hängt von der Tabelle ab, in der man sich gerade befindet.
Suchbegriff	internet	Begriff, nach dem in der ausgewählten Spalte gesucht werden soll
Kriterien mit ... -Operator verbinden	and / or	Suchbegriffe verknüpfen mit und bzw. oder. Es müssen entweder alle Begriffe vorkommen oder einer
	Filter hinzufügen	Weiteren Begriff in einer Spalte hinzufügen für eine Suche nach mehreren Kriterien
		Suche starten
		Suche starten und erweiterte Suche zuklappen

The following actions are available:

notempty
New as of v14.2.0

Copy VPN host
Edit
Delete

Configuration of the UTM

Add Clientless Host

Under VPN Clientless VPN click the + Add button.
All servers that are to be made available to users via the user interface using Clientless VPN are entered here.

Caption	Value	Description	Add Clientless Host UTMuser@firewall.name.fqdn VPN Create server
Servername:	Windows Server 2012 RDP	Assign a name for the host
Type:	RDPVNC	Service through which the host is to be accessed
Type:	notempty VNC is an unencrypted protocol. We also recommend a VPN connection between the server and the UTM. To increase the security of RDP between the UTM and the server, this connection should also be additionally protected by VPN.
Security:	NLA (recommended)TLSRDP (deprecated)	Choose the security protocol NLA (Network Level Authentication) requires authentication before a connection is established TLS and RDP first establish the connection and then require authentication. This favors e.g. DOS attacks.
IP address:	10.10.10.10	IP address of the host Preferably, the connection between the UTM and the server is established via VPN, so the tunnel IP address of the server is specified here
Port:	3389	Port that is enabled for access on the host
Domain		If entering a domain is required (e.g. in Windows environments), the domain can be specified here
User name Password		User name and password are passed directly for logging in
Video resolution:	1024x600	Resolution (selectable from 320x200 to 2540x1440 pixels) notempty extended as of v14.1.1 320x200 320x240 640x480 720x480 768x576 800x600 854x480 1024x600 1024x768 1152x768 1280x720 1280x854 1280x960 1280x1024 1400x1050 1440x960 1600x1200 1680x1050 1920x1080 1920x1200 notempty New as of v14.1.1 2540x1440 notempty New as of v14.1.1
Color depth:	24	Choose color depth (16 or 24 bit)
User groups notempty New as of v14.1.1		The connection can be assigned directly to a user group The group requires the permissions Userinterface and Clientless VPN
The resolution and color depth depends on the capabilities of the destination host and the clients from which the destination host is accessed via the browser. The entries Domain, Username and Password are optional for TLS and RDP. If these fields are left blank, the username and password will be requested when the host is accessed via Clientless VPN.

Group permission

Group permissions

Click Authentication Users Area Groups button + Add Group or existing group
in the Permissions section:
- Enable Userinterface with the On button
- Enable Clientless VPN with the On button
Assign a unique name in the Group name: field.

Subsequent assignment of the group

Assign server to the group

Switch to the Clientless VPN tab.
Activate desired clientless VPN connection with On
Apply the changes with

Allow access

Group permissions

Now it must be ensured that the clientless VPN user is also allowed to log in to the user web interface via the browser. This can be done either by Implicit Rules or by manually creating a corresponding Packetfilter Rule on the interface.
In this case it is sufficient to activate the User Interface Portal VPN rule with On in the menu under Firewall Implizite Regel Area VPN.

Apply CVPN

     | }}-->

Login to the user interface

The user login to the user interface is called up via the IP address or URL of the UTM, possibly followed by a port specification
Depending on the assigned permissions, various functions are made available
Click on the corresponding tile to access the desired function

Show step-by-step instructions

hide

Klicken für dauerhafte Anzeige

Configured	Port	Example call with IP	Example call with URL
Default	443	i.e. https://192.168.175.1	i.e. https://utm.ttt-point.de
Port changed bei administrator Menu: Network / Appliance Settings / Appliance Settings / Webserver / User Webinterface Port	4443	i.e. https://192.168.175.1:4443	i.e. https://utm.ttt-point.de:4443

notempty

The responsible admin must provide the IP address or domain name and, if necessary, the port for the user web interface

After entering the IP address, the user login page of he Securepoint UTM is loaded. The login credentials are entered there.

Value	Description	The login window User Login with the two and the optional third input box.
User	Username
Password	The associated password
OTP Code Optional	If this input box is displayed, a one-time password (OTP) must be entered The one-time password (OTP) is an authentication mechanism that provides additional security when a user logs in. The code to create OTPs must be supplied by the administrator
Login	You can log in to the user interface by clicking on this button after entering all login data correctly.

Start CVPN

Clientless VPN Clicking on the tile of the desired connection establishes the connection.

Run CVPN

If no user name and password are stored in the clientless VPN settings, they will now be queried.		Dialog for clientless VPN (CVPN) connection
Send Ctrl Alt Del	Sends the key combination
Extended full screen	Full screen display with dialog header incl. buttons
Full screen	Full screen display (exit with Esc)
Disconnect	Disconnects the connection
Clipboard	Only one file can be stored in the clipboard at a time A newly uploaded file or entered text will overwrite the content of the clipboard Files that are copied to the clipboard on the server can subsequently be downloaded as a compressed ZIP archive Uploaded files are available on the server in the clipboard. File exchange is not supported for VNC connections
Cursor	Always show local cursor:
Off	When activated On, the local cursor is displayed at the position of the remote mouse pointer. (The function on the remote device remains unchanged)

Hints

Windows 2012R2 with enabled terminal services

Group policy dditor

If a 2012R2 server is to be used as the RDP server for the clientless VPN, the establishment of the RDP connection fails due to the "Authentication at network level".
When using the terminal services, this function can also no longer be deactivated via the familiar way.

However, it is possible to force the disabling of ""Authentication at network level"" via the GPO (Group Policy).

Adjusting the registry

However, it may also be necessary to adjust a registry entry. This must have a value of 1.
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp SecurityLayer

notempty

For Terra-Cloud machines it may be necessary to adjust the registry entry.