I want to allow a specific VLAN to a specific server. LAN users should be able to access every server, but VPN users should able to only access a specific server.
Suppose User A (VPN user) comes onto the internal network for a specific server, he should able to access to that server only; no other servers should be accessible.
LAN users should have access to all servers in the LAN.
You seem to be confusing a VLAN with a subnet. While in most cases, VLANs and subnets are mapped one-to-one, they are not the same. I will answer your question assuming the following:
The LAN subnet, server subnet and VPN subnet are different, for these purposes I will use:
To start of, some information that is important to know about access rules, so this will make it easier for you to expand your rules later.
First you must identify your traffic:
You must also identify if your network devices automatically does reflexive ACLs or not. A reflexive ACL will allow traffic to return, once a connection has started up, without you needing to specify a rule for that. Most often: A firewall has reflexive rules, a switch/router doesn't.
To identify the direction of the traffic: Example: A computer requests a website from a server. It will normally do this with Destination IP the webserver-IP, source IP the computer-IP. Source port will be 'random'(TCP, greater than 1024) destination port will be TCP 80. The direction fo the ACL depends on where you apply the ACL. Just remember that in and out are from the point of view of the network device:
|-----------| IN |---------|OUT |-----------|
| | -->| |--> | |
| Computer | | router | | Webserver |
| | <--| |<-- | |
|-----------| OUT|---------|IN |-----------|
Best practice is to apply the access list as close as possible to the source, so in this case IN on the computers side. So the rule would be: Allow tcp connections from computer-ip port random to connect to webserver port 80. So, if we would want to allow the computer network to allow to access a webpage, we could make this access list on a cisco router:
ip access-list extended ComputerLAN
permit tcp 192.168.1.0 0.0.0.255 gt 1023 host 10.1.0.100 eq 80
Two points:
Now put it on the VLAN interface in the "IN" direction:
interface VLAN 192
ip access-group ComputerLAN in
If we want the server network to only return traffic that has been set up from the computers, you could put down the following. Here the word established means: Only traffic that has already started in the opposite direction.
ip access-list extended Servers
permit tcp host 10.1.0.100 eq 80 192.168.1.0 0.0.0.255 gt 1023 established
interface VLAN 10
ip access-group Servers in
In your case, if you want to only restrict VPN to one server, and allow everything else, you could do:
ip access-list extended VPN
permit ip 172.16.1.0 0.0.0.255 host 10.1.0.100
interface VLAN 172
ip access-group ComputerLAN in
Now, since we have not defined any access lists on the other VLAN interfaces, all other traffic is allowed. Oftentimes, you can already define in your VPN setup which traffic is allowed through your VPN, so you wouldn't even need this ACL.
