All right, now that we have a pfSense installed and our network segmented,
it's time to set up the remote access VPN connection,
tie ourselves back to the authentication server or Active Directory,
and segment those VPN users as well.
So, let's hop over to our jump box again,
and as you can see,
we have our firewall rules that we created in the previous demo,
and our MGMT network is a little bit more restricted now.
These are similar rules to what we have on the user side as well.
If we discover that we need any additional ones throughout the whole
process of configuring the firewall for VPN termination,
then we'll come back in here and configure some more.
But remember,
these firewall rules are for traffic that originates on those
interfaces or in the networks attached to those interfaces.
All right,
so the first thing that we need to do is go set up an authentication server.
To do that, I'm going to go to the User Manager and then Authentication Servers.
Right now we only have the local database,
so I'm going to go ahead and click Add, and we'll go
through the configuration options for this.
So our name is going to be our GloboDC_LDAP. We'll call it GloboDC.
Our host name or IP address, we'll type in the IP for it. We'll leave
it at the default port 389 and standard TCP. Our Peer CA is going to be
the Global CA because that's what we're going to use to validate the
LDAP server certificate itself. We'll leave the protocol version and
the timeouts the same, the search scope the same.
Our base DN is going to be dc=globomantics,dc=com. Okay.
And we'll leave our authentication containers alone.
If we wanted to add some of these, we could.
And as far as the authentication containers go, we'll go ahead and add those.
So we'll do cn=Users and then the dc=globomantics. And we'll change the
search scope to the entire subtree, that way we have the entire scope
there. We'll leave everything else the same.
The initial template is going to be Microsoft AD. So our user
naming attribute is going to be samAccountName, and then our
group naming attribute is going to be cn.
And then we're going to go ahead and make sure that this is UTF8 encoded and
we're not going to strip away parts of the username. All right.
We'll save that.
All right, and now that we have it created, we can actually go ahead and use it.
So now to set up the actual VPN connection,
we can either use the wizard to help walk us through it, or we can
configure it on our own. If we're using the wizard,
we just go over to the OpenVPN section, and there's
the Wizard button right here.
It makes everything fairly easy to do.
Just walks us through step‑by‑step and gives us options to input
different configuration parameters for it.
Instead, we're going to go just create it ourselves.
So in the servers area, we'll call this GloboVPN. In our options here,
we're going to select Remote Access (User Auth), and the back end for the
authentication, we're going to use our GloboDC back end, that LDAP back end
that we just configured. We'll leave it in tunnel mode. We'll leave it UDP
on IPv4. The port is going to be 1194.
We'll go through and configure these certificates.
We'll use the server certificate there.
We have options to select the encryption algorithms that we're going to use.
We're going to leave these the default as well.
So as you can see, there's a lot of configuration parameters that
we can actually set up here if you want to control how the
certificate authentication piece works, how the encryption works,
what algorithms you're going to use, so on and so forth.
And we're going to program our network in here. We'll force all
traffic through the tunnel, so we don't want to do split tunneling
here. And we'll provide our default information.
So our default domain is going to be globomantics.com.
We'll give them a DNS server as well.
And then if we wanted to, we can make Windows 10 clients
block DNS servers, except for across the VPN.
I'm not going to make any custom options here. And then
we'll leave the logging at default.
All right, so our connection is set up now. And now before we can actually
connect to the VPN, we need to install what's called a package.
So there's an export package for OpenVPN that we
have available to us right here.
It's called the client‑export package.
So we'll go ahead and install that. And what this does is it
gives us an easy way to export the configurations and the
OpenVPN client if we need it.
These pfSense packages are really cool and really help us expand a
lot of the functions of the pfSense firewall.
All right, now that that's installed,
let's go back to OpenVPN, and as you can see, we have this Client Export piece
here. So, the remote access server that we configured just now is right here.
We're using the IP address for the resolution.
We are going to verify the server, and then I'm not going to
do any advanced configuration options here.
Now here we have a couple of different options as far as downloading the
client and the configuration parameters themselves.
So what I'm going to do is hop over to our other Windows box that's still
connected to the user network and download this stuff, and then we'll
change the network over to simulate the outside network and allow it to
connect to the VPN. So we'll download this. And I'm going to choose the
Inline Configurations for most clients, and then the Current Windows
Installer as well.
Okay, now let's throw those on our Globomantics share.
All right.
And there we go, now that that's on the share, we'll go over to our Windows box.
All right.
And we'll go ahead and run that to install the OpenVPN client on this computer.
We'll let it run through the installation.
Now this makes it really easy for us to be able to quickly
deploy via GPO or anything like that.
All right, now that the installation is completed,
we'll go ahead and close the installer and then hop
over to vCenter. And as you can see,
we're still on the Globo_31 network, so let's go ahead and edit the
settings for this virtual machine and change the network over to the 10
network, that outside network that we're replicating.
All right, let's verify our IP address. All right.
We're in the 10 network.
So let's go ahead and see if we can connect to the VPN.