topic Restrict IPv4 Remote Access VPN in Firewall and Security Management

Restrict IPv4 Remote Access VPN

Christoph — Tue, 17 Oct 2023 08:34:11 GMT

Hello,

I need to restrict the list of users able to connect via Remote Access VPN to a list of fixed IP addresses.

There are posts, with identical requirements dating back to 2018 with no solution.

The more popular request for geolocation blocking has no solution either, but is also a few years old.

Has anyone successfully implemented such a solution, with a Check Point Firewall?

Cheers

Christoph

Re: Restrict IPv4 Remote Access VPN

Chris_Atkinson — Tue, 17 Oct 2023 08:40:47 GMT

The Geo restrict option is possible using this solution:

https://community.checkpoint.com/t5/Security-Gateways/Block-VPN-Traffic-by-Country/td-p/172695

Re: Restrict IPv4 Remote Access VPN

G_W_Albrecht — Tue, 17 Oct 2023 08:55:39 GMT

This is not relevant on the CP RA VPN but on your clients - these each need a fixed routable IP and a corresponding entry in the GW rule base. As this is not the cheapest solution it is not used so much 😉. Most customers restrict the list of users able to connect via Remote Access VPN by defining groups of users that should be able to connect 8) and do not allow others...

Geoblocking is dangerous - a customer was only allowing RA VPN clients from his home country and had to fight the "wrong county for IP" issue a couple of times. Would be nice if it worked 100% but can be deemed not usable if a client can be restricted from access for 1-2 weeks until it is corrected.

Re: Restrict IPv4 Remote Access VPN

Christoph — Tue, 17 Oct 2023 08:47:16 GMT

Hello Chris,

thank you very much. Didn't found this while looking for a solution. I will check if I can break this down to a single IP or group of IPs.

Cheers

Christoph