[Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 403
  • Last Modified:

Firewall Rules for SSL VPN

Our company infrastructure provision a SSL VPN gateway on the Internet DMZ which is behind a firewall. The VPN gateway basically receive inbound VPN connections to allow VPN client to access the internal resources.

We need to setup a firewall rules to allow incoming traffic to the TCP port 443 as follows:

Status    Action    Source ip     port     Destination          port
Active      Allow      Any                   Any      10.106.xx.xx        443

My question is do we need to setup a outgoing firewall rules as well to allow for such VPN client connection ?

Thank you for your kind advice in advance.

1 Solution
David Johnson, CD, MVPOwnerCommented:
Simple answer is yes both inbound and outbound.

the port requirements vary greatly by vpn and supporting infrastructure

A better explanation : http://technet.microsoft.com/en-us/library/dd458955%28v=ws.10%29.aspx
Your firewall should be smart enough to allow the full TCP connection to the SSL VPN gateway located in your DMZ once you define the rule to allow TCP/443 traffic to it, so I don't think you need an outbound rule on the DMZ interface. The real question is where is the inside of the VPN appliance terminating? Many VPN appliances would have two interfaces, an outside or untrusted interface on the Internet (or DMZ), and an inside interface through which decrypted traffic flows through to the rest or your private network. VPN client traffic egressing the inside or trusted interface must be permitted by whatever firewalls and routers that are between the trusted interface of the VPN appliance and the rest of your network.

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now