0

This question is a follow up on this question. We are currently working on the network design, nothing is implemented yet.

Our network will exist out of our own (internal) network and lot of customer networks connected via IPSec. Our employees need to have (direct/VPN) access to all customer networks with less effort as possible. They need to see web interfaces, ip cams, live streams and so on which are present in the networks of our customers.

We also want to give customer employees (VPN) access to their own network(s) but they are not permitted to see or access networks of other customers. Note that 1 customer can have multiple sites so multiple networks.

With the information of my previous question we think we need a subnet for each customer site and 1 for the VPN users of the customer. With this division we can manage the access to network via firewall rules.

E.g. request from our internal network or subnet where our employees are in can access all other subnets. Request from a customer user subnet (VPN) can only access subnets of their own sites.

Probably we will use OpenVPN (or similar) for VPN users (so our and customers employees). They get an (VPN) IP assigned by the VPN server so they are in the correct subnet.

Now we are thinking that it will be a lot of effort to manage VLAN's when we create one for each customer. We are also limited to the amount of VLAN's we can create. So we are curious if it is safe to set all the customer sites and VPN users in 1 VLAN, the "customer VLAN".

I mean, as long as the VPN user has an IP in the correct subnet, he can only access his own networks but i'm not sure if he can manipulate his (VPN) ip address so he is in antoher subnet. When this is possible he can access other networks by simply changing his VPN IP.

Is it possible that a user can change his VPN IP? and if it is, can we protect this in a scalable way with having less as possible management effort? E.g. only allow a specific IP range (e.g. 10.10.10.0/24 - 10.10.10.255/24) for a specific certificate?

I hope my question is clear like this as its pretty complicated for me to bring this on paper (or screen :P) Just to make it a bit more visual i added the scheme sketch bellow.

enter image description here

Improve this question

3 Answers 3

Reset to default
1

Is it possible that a user can change his VPN IP?

That depends on your VPN solution. With most, it's not possible for a client to change their address. You should put that on your requirement list.

and if it is, can we protect this in a scalable way with having less as possible management effort?

Potentially, you could use user authentication at the firewall (instead of IP ranges) to control access to remote networks, but that most likely means firewall and client VPN need to integrate, narrowing down the options. Using IP address ranges (and making sure they cannot be spoofed) is a means to keep client VPN and firewall separate.

Do i need VLAN per customer when i want to give users (secure) access to specific customer sites

Most likely not. If you use routed (L3) VPN there's no need to keep each client in their own VLAN (it isn't even possible). If you make sure that client addresses cannot be spoofed the address is valid identification for the client and its access privileges.

VLANs are used to split an otherwise "flat" L2 network into distinct segments. If there's no shared L2 network that untrusted device attach to there's nothing to split.

Improve this answer
4
  • Thanks, i will try to find more information about user identification on the firewall. We probably use pfSense and has e.g. OpenVPN on board, maybe they support something like that as that would be great!. -- If its not possible i will try to "configure" the restrictions to networks they can access in the VPN configuration as this will also avoids creation of a lot of firewall rules for each client. -- possible disadvantage of network "permission" management via OpenVPN is that i possibly need to change multiple client configs when i need to add aa new site to customer employees
    – CodeNinja
    Commented May 7, 2020 at 6:30
  • I just found OpenVPN Access Server and in first view it looks like a good solution for our situation. I will dive into that as it looks like they provide all our needs and makes maintenance/management pretty easy.
    – CodeNinja
    Commented May 7, 2020 at 7:55
  • 1
    With OpenVPN, you could also use dynamic client addresses (per group address pool, usually /25) for default client-specific access, and a per-user static address when specific privileges are required, e.g. for a management subnet (at least that's how we do it).
    – Zac67 ♦
    Commented May 7, 2020 at 14:04
  • Thanks for the suggestion. I'm looking into OpenVPN Access Server right now and it looks really awesome! it cost 18 dollar a year per connection but that is not an issue as the customer pays for it. It seems to cover all our needs and it makes it very maintainable as it support user groups. Its seems that its possible to grant access to specific networks on group level. I only setup a server until now and need to build a test setup to find out if it works like expected. -- Thanks for your post (ant the others) it really helped me out and send me in the right direction!
    – CodeNinja
    Commented May 7, 2020 at 14:07
2

Is it possible that a user can change his VPN IP? and if it is, can we protect this in a scalable way with having less as possible management effort? E.g. only allow a specific IP range (e.g. 10.10.10.0/24 - 10.10.10.255/24) for a specific certificate?

It depends on the VPN software and configuration, but probably not. Even if they were, it would only be within the subnet they were assigned.

The VPN configuration can specify what networks are accessible, so Customer-employee 1 will only be able to reach Customer 1 networks.

VLANs have nothing to do with any of this.

Improve this answer
1
  • Thanks, this is usefull information. Especially "The VPN configuration can specify what networks are accessible" i need to dive in this a bit more. I will try to setup net customer accounts/sites with less effort as possible so need to find the right way to do the configuration.
    – CodeNinja
    Commented May 7, 2020 at 6:26
0

As an alternative to L3VPN, some of my clients do as Zac67 suggests, and use VPNs with ACLs. I'm doing a new implementation soon, with OpenVPN configured to invoke a script upon user connection to provision the appropriate ACLs so users can access the IPMI cards and other resources associated with their user account. I'm doing it with a fairly self-documenting iptables & ipset configuration.

There are numerous ways to do this. Which is best for your environment depends a lot on scale and on whether the customer devices need to communicate across sites or not (I believe in your case, they don't.)

Improve this answer
2
  • ACL sounds like music in my ears when it comes to maintainability. -- When i understand correctly, you "create" the required firewall rules (Which is pfSense in our case) with a script at the moment a user connects to the VPN? And maybe remove the rules when the user disconnects?
    – CodeNinja
    Commented May 7, 2020 at 6:24
  • Yes, that's what we're doing with this implementation. I'm not familiar with pfSense but a quick search turned up a few relevant articles about configuring it when OpenVPN users connect. There are probably some good resources to help you get started.
    – Jeff Wheeler
    Commented May 7, 2020 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.