VPN tunnel Question

[ianbla]

We have a customer who we can VPN into to perform checks. Now if the consultant on the internal LAN VPN's into the client does all traffic then bypass the Firewall rules because it is in an encrypted tunnel? eg port 1434 is not allowed through the firewall but could this pass through the tunnel?

 

[tbissett]

The answer is Yes, assuming your access-list for VPN traffic is permitting everything (IP). There is only one exeption: If you have an access-list on your INSIDE interface, it's rules will be checked before the traffic goes to the VPN tunnel.

 

[ianbla]

With the tunnel starting between the consultants laptop and the client system wouldn't this also be ignored once the tunnel was established as all the data would be encrypted.

 

[LoopyLoo]

NO. The access list on the inside interface acts on all traffic coming to the inside interface from inside. The encryption is normally done at the inside interface after the access lists are processed. Think of the interface having two sides - lan side and router side. The access-lists work on the lan side and the encryption is done on the router side before being shoved out the WAN interface to the other router.

 

[ianbla]

I thought the VPN software sitting on the laptop would encrypt/decrypt and thus bypass the firewall ACL's.

If I look at the SYSLOG I can see the initial connection and then nothing.

 

[LoopyLoo]

I misunderstood. TBISSETT is right - the access lists at your end are bypassed. Where does the tunnel end? You might want to put an access-list at that end. Alternately remove SQL from the connecting laptop.

 

[yizhar]

HI.

Yes, the VPN traffic is hidden to the pix (unless the pix is a peer which is not the case here).

You should not worry too much about this because:
A. The tunnel is establish on demand and only from your side (consultant) to the other remote network.
Your consultant acts as a VPN client only and will/should not act as VPN server for reverse sessions.
B. Once the VPN tunnel is established, the consultant's computer does not act as a router, which means that the remote VPN side cannot forward packets to your SQL server via the VPN tunnel.

However you should verify that the computer of the consultant does not share its C drive over the VPN tunnel, as this could be risky.
This depends on the VPN client software you have, and anyway you should not share the C drive at all, which is probably the current status.

Bye

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar