Help - Block VPN SSL user to connect internet

[papapuff]

Hi there,

need help please.

I want to configure, whenever user(s) connect to office network over VPN SSL, they can't access to internet (browsing,  emailing, etc).

We use FG60D with firmware 5.0.

thank you

[soonguan]

you can do full tunneling (without split tunnel) so the fortigate will sent the default route to forticlient user's PC (this default route inject from fortigate will override the default route of the pc). With this, all the pc connection go through the SSL VPN tunnel to fortigate. 

In your fortigate policy, if you want allow this user to internet, you got to use ssl.root-> internet(wan) policy, if without this policy, the forticlient ssl vpn user not able to access internet, means they need to disconnect the ssl vpn in order to flush the default route that fortigate inject to access internet using their own original default gateway.

[patrick_z]

Hi,

well for me it's working in both situations. Policy + Interface

I'm on version 5.2 and it's working like it should. You need to set the split tunnel in the portal and put there the range(s) that should go via tunnel. All the other stuff is not going via tunnel. You can test that via trace on the client. It might be, that the DNS you give with the SSL login should be able to resolve for public DNS as well. I have not tested that explicit.

Cheers, Patrick

[ttreat]

Is it possible to block a user from getting to the public internet who is logged in only to the SSL web portal (not the forticlient full tunnel), or maybe at least ensure the public access can only be accessed via the web portal? Sort of like disabling split tunneling in tunnel mode. Can it be done it Web portal mode?

I have it setup so that split tunneling is not enabled, and when I connect via the forticlient it works as expected. The traffic is either blocked or forced to go through the tunnel/firewall (depending on whether I enable the rule to allow access to public internet for VPN user groups). I was curious if I could do the same thing to the users in VPN-Web-only user group? Now that I think of it, I guess this to be expected since a web portal only user would not have full tunnel access to internal LAN so there wouldn't be as much reason to want to prevent that person's access to less secure public internet while connected to web portal. Sound reasonable or am I missing something?

Another thing I notice is that when connected to VPN tunnel with Forticlient with NO split tunnel and no policy to allow internet access, I can still get to IPv6 only sites. The test pc has a IPv6 address and I can tracert and ping directly to public IP addresses without going through the tunnel. I only have IPv4 policies and IPv4 addresses on the firewall. This  sort of reminds me of  the IPv6 DNS leakage issue with the commercial VPN's. Many people now get valid IPv6 addresses on their home (e.g. comcast) connections. To block their internet access while in a VPN tunnel would I have to configure my firewall with IPv6 versions of everything? (Policies, IP addresses, etc)

Thanks!