Restrict IPv4 Remote Access VPN

[Christoph]

Hello,

I need to restrict the list of users able to connect via Remote Access VPN to a list of fixed IP addresses.

There are posts, with identical requirements dating back to 2018 with no solution.

The more popular request for geolocation blocking has no solution either, but is also a few years old.

Has anyone successfully implemented such a solution, with a Check Point Firewall?

Cheers

Christoph

[Chris_Atkinson · Accepted solution]

The Geo restrict option is possible using this solution:

https://community.checkpoint.com/t5/Security-Gateways/Block-VPN-Traffic-by-Country/td-p/172695

[Christoph]

Hello Chris,

thank you very much. Didn't found this while looking for a solution. I will check if I can break this down to a single IP or group of IPs.

Cheers

Christoph

[G_W_Albrecht]

This is not relevant on the CP RA VPN but on your clients - these each need a fixed routable IP and a corresponding entry in the GW rule base. As this is not the cheapest solution it is not used so much 😉. Most customers restrict the list of users able to connect via Remote Access VPN by defining groups of users that should be able to connect 😎 and do not allow others...

Geoblocking is dangerous - a customer was only allowing RA VPN clients from his home country and had to fight the "wrong county for IP" issue a couple of times. Would be nice if it worked 100% but can be deemed not usable if a client can be restricted from access for 1-2 weeks until it is corrected.