Last adaptation to the version: 14.1.1 (11.2025)
- Beim Konfigurieren einer Verbindung können Benutzergruppen direkt mit ausgewählt und in der Tabelle angezeigt werden
- Die Übersichts-Tabelle der CVPN-Verbindungen wurde um zahlreiche Informationen ergänzt
- Wählbare Videoauflösungen wurden erhöht
Introduction
UTMuser@firewall.name.fqdnVPN
Übersicht der Clientless VPN Verbindungen notemptyClientless VPN provides the ability to connect to an RDP or VNC server on the corporate network via the browser. Users log in to the user interface and are then given the option to connect with a designated server. For this to work, the browser must have HTML5, Java or similar is not necessary.
Die Übersicht zeigt zahlreiche Informationen an:
- Servername
- Typ
- IP-Adresse
- Port
- Domain
- Benutzername
- Videomodus
- Sicherheit
- BenutzergruppenCVPN-Benutzer Zugeordnete Gruppe mit Clientless VPN-Berechtigung
CVPN-Benutzer Zugeordnete Gruppe ohne Clientless VPN-Berechtigung
Configuration of the UTM
Add Clientless Host
Under click the button.
All servers that are to be made available to users via the user interface using Clientless VPN are entered here.
| Caption | Value | Description | UTMuser@firewall.name.fqdnVPN  Create server
|
|---|---|---|---|
| Servername: | Windows Server 2012 RDP | Assign a name for the host | |
| Type: | Service through which the host is to be accessed | ||
| notempty VNC is an unencrypted protocol. We also recommend a VPN connection between the server and the UTM. In general, even when using RDP, it is recommended to protect the connection with a VPN to ensure authenticity. | |||
| Security: | |
Choose the security protocol
| |
| IP address: | 10.10.10.10 | IP address of the host
| |
| Port: | 3389 | Port that is enabled for access on the host | |
| Domain | Ist die Eingabe einer Domain erforderlich (z.B. in Windows Umgebungen) kann hier die Domain vorgegeben werden | ||
| Benutzername Kennwort |
Benutzername und Kennwort werden für die Anmeldung direkt übergeben | ||
| Video resolution: | Resolution (selectable from 320x200 to 2540x1440 pixels) notempty erweitert ab v14.1.1
| ||
| Color depth: | Choose color depth (16 or 24 bit) | ||
| Benutzergruppen notempty New as of v14.1.1 |
Die Verbindung kann direkt einer Benutzergruppe zugewiesen werden Die Gruppe benötigt die Berechtigung Userinterface und Clientless VPN | ||
| The resolution and color depth depends on the capabilities of the destination host and the clients from which the destination host is accessed via the browser. The entries Domain, Username and Password are optional, if these fields are left blank, the username and password will be requested when the host is accessed via Clientless VPN. | |||
Gruppenberechtigung
UTMuser@firewall.name.fqdnAuthenticationUser 
Group permissions
- Click Area Groups button or existing group
- in the Permissions section:
- Enable Userinterface with the On button
- Enable Clientless VPN with the On button
- Assign a unique name in the Group name: field.
Subsequent assignment of the group
- Switch to the Clientless VPN tab.
- Activate desired clientless VPN connection with On
- Apply the changes with
Allow access
UTMuser@firewall.name.fqdnFirewall 
Group permissions
Now it must be ensured that the clientless VPN user is also allowed to log in to the user web interface via the browser. This can be done either by Implicit Rules or by manually creating a corresponding Packetfilter Rule on the interface.
In this case it is sufficient to activate the User Interface Portal VPN rule with On in the menu under Area VPN.
CVPN anwenden
Login to the user interface
- The user login to the user interface is called up via the IP address or URL of the UTM, possibly followed by a port specification
- Depending on the assigned permissions, various functions are made available
- Click on the corresponding tile to access the desired function
| Configured | Port | Example call with IP | Example call with URL |
|---|---|---|---|
| Default | 443 | i.e. https://192.168.175.1 | i.e. https://utm.ttt-point.de |
| Port changed bei administrator Menu: Network / Appliance Settings / Appliance Settings / Webserver / User Webinterface Port |
4443 | i.e. https://192.168.175.1:4443 | i.e. https://utm.ttt-point.de:4443 |
notempty
After entering the IP address, the user login page of he Securepoint UTM is loaded. The login credentials are entered there.
| Value | Description |  |
|---|---|---|
| Username | ||
| The associated password | ||
Optional |
If this input box is displayed, a one-time password (OTP) must be entered The one-time password (OTP) is an authentication mechanism that provides additional security when a user logs in. | |
| Login | You can log in to the user interface by clicking on this button after entering all login data correctly. | |
CVPN starten
Mit einem Klick auf die Kachel der gewünschten Verbindung wird diese aufgebaut.
CVPN ausführen
| Ist kein Benutzername und Passwort in den Clientless VPN Einstellungen hinterlegt, werden diese nun abgefragt. |  | |
| Sendet die Tastenkombantion | ||
| Vollbild Anzeige mit Dialog-Header inkl. Schaltflächen | ||
| Vollbild Anzeige (Beenden mit Esc) | ||
| Trennt die Verbindung | ||
| Zwischenablage |
| |
| Cursor | Lokalen Cursor immer anzeigen: | |
| Off | Bei Aktivierung An wird an der Positiion des entfernten Mauszeigers der lokale angezeigt. (Die Funktion auf dem entfernten Gerät bleibt davon unverändert) | |
Hints
Windows 2012R2 with enabled terminal services
If a 2012R2 server is to be used as the RDP server for the clientless VPN, the establishment of the RDP connection fails due to the "Authentication at network level".
When using the terminal services, this function can also no longer be deactivated via the familiar way.
However, it is possible to force the disabling of ""Authentication at network level"" via the GPO (Group Policy).
Adjusting the registry
However, it may also be necessary to adjust a registry entry. This must have a value of 1.
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
SecurityLayer