We have customers spread over the whole continent. We deliver and install hardware at the customers site and completely set up and configure the network for them. After the installation is done, we want to be able to manage all the customer networks, servers, ip-cameras and other "smart" hardware remotely. The customer needs also be able to "access" their own network(s)/site(s) remotely.
The current requirements are:
- Our internal "office employees" should be able to access all client sites remotely from our office(s)
- Our service employees which are "on the road" need to be able to access all client sites from any location
- Our customers need to be able to access their own sites remotely from any location, including via mobile phone
- We preffer centralized connection / user management
- There should be an option to use MFA to access the VPN
- It should be simple as possible for our employees and customers to setup the remote connection and manage the devices in their network (SSH, HTTP, steams,...)
- Its not required that there are conenctions between customer sites, they operate indivitually from eachother
Currently we achieve this by having OpenVPN clients at the customer sites, from there on we can "hop" further into the network. This works fine for SSH connections but is complicated for customers and our employees to manage applications or devices with web interfaces. We also don't have a device at the customers site where we can install an OpenVPN client on. In this situations so we need to install an extra (Linux) device for this. For this reason we are looking for another solution.
Currently we have an PfSense firewall which support L2TP/IPSEC so it would be great if we can use this for the VPN connections. If a seperated VPN server is recommended for this, we have also the ability to run a VM internally for this.
- Are there best practices for situations like this?
- Is L2TP/IPSEC suitable for this scenario or is there a better solution? (in terms of max amount of site's or user management)
How can i achieve that our employees can access all sites and customers only sites we gave them permission to
If the VPN "achitecture" i described (independently of L2TP/IPSEC) is the way to go, how should i deal with IP ranges as DHCP should run on the client site in case VPN connection is lost.
- DHCP on client site, each site in antoher subnet?
I Googled about L2TP, site2site VPN, site2multi-site VPN connections and so on but could not find a clear answer to the questions above. I hope someone can help me or send me in the right direction.