Restrict VPNSSL access per user

Forum|Forum|3 years ago
January 12, 2023
10 replies
5094 views

I'm looking for a way to restrict VPNSSL access from a certain source IP for some users. As far as I know, I can do it but it will affect to all users. Is there any workaround to solve it?

FortiGate

Julien87

Contributor II

Hi llarena,

Modification : it's very bad solution ;)

I don't think the option exists. Source filtering is global to the SSL configuration.

~~If I had to do something unconventional. I will do for example:~~
~~1) Add a different realm per user group (feature to be activated)~~
~~2) Listen SSL VPN on a Loopback interface port 10443~~
~~3) Add a VIP on the WAN interface port 30443 to the loopback vpn ssl interface 10443~~
~~4) Add a rule with authorized wan source IPs to the loopback vip.~~
~~5) Use another port for the VIP and another Realm for other users who do not have this limitation.~~

~~it will work as long as the port of unfiltered users is not known by other users.~~

I don't like my solution... but it works

Best regards

IlarenaAuthor

New Member

Hi Julien,

Thanks for the proposal. I'm afraid I cannot change the port. We're using standard 443 port because many places block non standard ports and we don't have any IP available to use it.

Bests,

Iñaki

IlarenaAuthor

New Member

Looks that there's an option at the authentication-rule that allows to add a source address:

config vpn ssl settings config authentication-rule edit N set source-interface <interface-name> set source-address <firewall-address-object>

But it's not working. Does anyone use it?

pminarik

Staff

This is the right place. The restriction will apply to the user/group mentioned in the authentication-rule. Be aware that this restriction is applied at the time of logon (a logon attempt will result in failure if the src IP doesn't match, even if correct credentials are provided). It will not block TCP connection to the port. (a random client will be able to display the login page)

The VPN port responds to TCP SYN if it matches any IP from the list of permitted sources in the general SSL-VPN settings (any by default) and and any source in any authentication-rule (any by default).