notempty
- Updated to Redesign of the webinterface
- It is possible to allow duplicate clients with the same credentials (v12.5.1)
Introduction
A roadwarrior connection links individual hosts to the local network.
This allows, for example, a field worker to connect to the headquarters network.
SSL-VPN uses the TLS/SSL standard to encrypt the connection.
There is a separate article for creating certificates on the UTM: Certificates
Preparations
These certificates can also be created during setup if necessary.
Internal hostname resolution in SSL-VPN
If servers in the SSL-VPN are to be accessible to Roadwarrior under their host name, the following settings are required:
Push DNS/WINS
In order for DNS/WINS to be transmitted, the configured VPN connection must be edited Advanced tab.
and enabled in the
Search Domain
Block Outside DNS
For some Windows 10 clients, it may be necessary to set the "block-outside-dns" option in the configuration of the SSL-VPN client:
Right click on the desired connection in the Securepoint SSL-VPN Client, menu Settings Advanced button tab OS Entry DNS Block Outside DNS
Roadwarrior configuration
Setup Wizard
After the login on the firewall's administration interface (by default: https://192.168.175.1:11115), the setup wizard can be called up with Button .
Step 1 |
UTMuser@firewall.name.fqdnVPNSSL-VPN | ||||||||||||||||||
In installation step 1, the connection type is selected. The following connections are available.
For the configuration of the Roadwarrior Server this one is selected. | |||||||||||||||||||
Step 2 |
|||||||||||||||||||
If IPv6 is to be used in the source and destination network, this must be enabled here. | |||||||||||||||||||
Step 3Local settings for the Roadwarrior server can be made in step 3. | |||||||||||||||||||
|
|||||||||||||||||||
Step 4 |
|||||||||||||||||||
In installation step 4, the transfer network for the Roadwarrior is entered. The transfer network can be freely selected, but must be otherwise unused on the UTM. | |||||||||||||||||||
Step 5 |
|||||||||||||||||||
The user authentication is selected in the last step. After that, the setup wizard can be completed.
| |||||||||||||||||||
Completion |
UTMuser@firewall.name.fqdnVPN | ||||||||||||||||||
In the SSL-VPN overview all configured connections are displayed. In order for the connection to become active, the SSL-VPN service must be restarted: | |||||||||||||||||||
Verbindung bearbeiten
Policy
Implied rules
Network objects
A tun interface was created when the connection was set up. It automatically receives the first IP address from the transfer network configured in the connection and a zone "vpn-ssl-<servername>".
The Roadwarrior clients will receive an IP address from this network and will be located in this zone.
To grant the roadwarriors access to your own network, a network object must be created.
Paketfilter Regel
Creating users and groups
Group
Berechtigungen | UTMuser@firewall.name.fqdnAuthenticationUser | |
Under Group Button . The following authorisations must be given:
| Area ||
SSL-VPN | |||
Client downloadable in the user interface: | Yes | Per default over the port 443, so e.g. under https://192.168.75.1 accessible | |
SSL-VPN connection: | RW-Securepoint | Select just created connection | |
Client-Certificate: | Client-Certificate | Selection of the client certificate described in Step 3 of the setup wizard.
| |
Remote Gateway: | 192.0.2.192 | The remote gateway is the address of the external interface. This address must be accessible external. | |
Redirect Gateway: | Off | When activated, requests from roadwarrior clients to the Internet or networks outside the VPN are also redirected via the local gateway. As a result, these connections also benefit from the protection of the UTM. | |
Available in the port filter: | Ja | Ermöglicht Identity-Based Firewall (IBF) für SSL-VPN | |
User
General | |||
Groups: | ×RW-SSL-VPN | The user must be assigned the previously created group. | |
SSL-VPN | UTMuser@firewall.name.fqdnAuthenticationUser | ||
Use settings from the group: | On | If settings have already been made for the group, these can be adopted here instead of individual values. | |
If the information has been saved, the corresponding files can already be downloaded by the administrator at this point. | |||
Further information on users can be found in the article on User Management. | |||
The SSL-VPN Client
Downloading the SSL-VPN client in the user interface
Für Benutzer, die sich per SSL-VPN mit der UTM verbinden möchten, stellt die Appliance einen vorkonfigurierten SSL-VPN Client zur Verfügung:
- Zum Download gelangt man über den Menüpunkt .
- Dieser Client enthält die Konfigurationsdateien sowie sämtliche benötigten Zertifikate.
- Anmeldung im Userinterface der UTM per default über den Port 443, also z.b. unter https://192.168.75.1
- Erreicht wird das Userinterface über das interne Interface der Securepoint Appliance.
The client is offered as:
- SSL-VPN Client Installer
- Required processor architecture: x86 / x64
- SSL-VPN Portable Client
- The portable version can be copied to a USB stick, for example, and can thus be run on other computers.
- Required processor architecture: x86 / x64
- Configuration and certificate
- For use in other SSL-VPN clients
- a configuration file
- the CA and client certificates
- and a driver for the virtual TAP network interface.
- To install the virtual TAP interface, the user needs administrator rights on the machine being used.
notempty
Installation: Hints for the installation can be found on our wiki page for the VPN client.
Establish SSL-VPN connection as client
Double-click on the lock icon in the taskbar to open the SSL-VPN client.
Start the connection by clicking
Multiple VPN servers as targets for one connection
In the settings of a connection under Advanced/Remote additional VPN servers with IP or hostname can be stored as destination.
Use multiple VPN profiles
Multiple VPN profiles can be imported and used at the same time.
- By clicking ... in the source file:section, a file in .ovpn format can be selected.
- In the Import as:section, either the filename or any custom identifier can be selected, which will then be displayed in the client window for that connection.
- Finish with the button.
Notes
Encryption
By default, an AES128-CBC method is used. The encryption method can be customized in the server or/and client profile.
notempty
If the client uses this cipher and is not able to handle NCP, with which the cipher is negotiated automatically, no connection is established. The cipher must be adjusted.
It is strongly recommended to stop using the BF-CBC cipher because it is considered not secure.
If the BF-CBC cipher is to be used anyway, it can be selected explicitly.
Adjustment on the UTM with the button of the respective connection in the General tab in the Cipher for data connection field. setting of the
Hash method
By default, a SHA256 hash method is used. The hash method can be customized in the server or/and client profile.
QoS
For the VPN connection, the TOS fields for automatic QoS can be set in the packets. This setting can be enabled in the VPN connection settings under "Advanced".
Note on upstream routers/modems
There are always problems with the stability of the connection if a router/modem in front of the appliance also has an active firewall. Please do not use any firewall functionality on these devices.
IPv6 for incoming connections
In the settings of the roadwarrior server General / Protocol.
, the protocol or for IPv6 can be activated under
Troubleshooting
For advice on troubleshooting SSL-VPN, see the Troubleshooting Guide SSL-VPN (pdf document).