All right, and I'm going to keep my credentials the same.
Going to use my joeadmin account,
and this is not configured in the local firewall users.
Oh, and it looks like we connected.
We have an IP address of 192.168.32.3, which is in that scope.
And as you can see right here, we have our OpenVPN adapter with that address.
And now remember previously how we weren't able to connect to the firewall GUI,
and now we do have our connectivity here.
And let's refresh our firewall rules.
And now you can see we have this OpenVPN one,
and there's nothing being allowed here.
So what this means is that we need to create rules
similarly to how we did in the previous demos,
segmenting our management and user networks to allow
traffic for these VPN networks.
So let's create an allow IP any rule real quick,
which is not a best practice for security,
but as you can see,
we now have access to Google after I hopped back over to my
Windows box that's connected to the VPN.
So this is awesome.
We successfully authenticated and established a remote access VPN.
If you look in the User Manager, there's no internal users here.
And again, to double‑check the actual VPN,
we're using the GloboDC as the back end for authentication,
not the local database.
So now the only thing that we have left to do is to configure
our firewall rules for that VPN connection.
We don't want to leave it wide open, we don't want to permit any anyone.
So let's go ahead and delete that.
And I'm going to go ahead and speed up the video while I'm creating all
of the firewall rules that we want for the VPN access.
Okay,
now that we have those basic firewall rules for our VPN connection configured,
we should be good to go, and our VPN users should have basic access.
Let's go double‑check that we still have access to Google.
And actually,
let's change this to a different service just to make sure
that we're not caching any web pages, and there we go.
And now,
similarly to how we talked about earlier with creating these
rules to allow access to only specific services in the
management network and everything like that,
what we're going to do is go through and configure all of these
rules for a specific source and destination,
and I'm going to speed up the video again to do that,
and then we'll talk about some of those nuances after.
Okay, now that we're done configuring those rules a little bit more specifically,
let's talk through them.
So, as you can see,
I went ahead and created that rule not allowing 443
traffic over to the management network, and later on,
I'll go through and do it with other services like port 80
as well and ones that we don't need.
We have our DNS requests now going specifically to our DNS
server internally from this OpenVPN connection.
LDAP, same, it's only going to our domain controller.
So as you can see,
these rules are even more specific now than the ones on the user interface,
so we can be more restrictive.
And so the goal with both the segmentation and remote access service
restrictions is so we can properly segment our network and create
these firewall rules so that we have less network traffic that's
going to the different segments, logging for whenever those connections happen,
and then also so that we can better secure these services and
the network functions that we're providing.
So we wouldn't want our host connecting to any DNS servers
outside of the ones that we host if that's,
you know, our organizational policy or our intentions.
So we want to button up and only allow the services to the specific destinations
that are hosting those services as much as we can control.
Remember,
configuring your firewall to open up the rules for allowing specific services
and stuff like that is a really good security posture to have,
and it's difficult to do if you're not aware of all the
applications and services that you see across the network.
So after you initially configure these,
then you'll have to field the requests for ports being
opened or protocols being opened,
and specific source and destination traffic being opened up,
or have a list ahead of time to create these rules with
and then tweak and tune it as needed.