Configure remote access SSL VPN as a full tunnel

When you configure remote access SSL VPN connections in full tunnel mode, all traffic from remote access SSL VPN users flows through the firewall. They can only access the permitted network resources you select in the SSL VPN policy.

Users can establish the connection using the Sophos Connect client.

Network diagram

See the video Configure remote access IPsec and SSL VPN.

Prerequisites

Make sure you've configured IP hosts for the network resources remote users can access. You must also configure users and groups in the firewall.

Create IP host for local subnet

Here's an example subnet for the network resources remote clients can access.

1. Go to Hosts and services > IP host and click Add.

2. Enter a name and network for the local subnet.

   

3. Click Save.

Create a user group and user

Create a user group for remote SSL VPN and add a user if you haven't already done it.

1. Go to Authentication > Groups and click Add.

2. Specify the settings.

   Name	Value
   Name	Remote SSL VPN group
   Surfing quota	Unlimited internet access
   Access time	Allowed all the time

3. Click Save.

4. Go to Authentication > Users and click Add.

5. Specify the settings.

   Name	Value
   Username	john.smith
   Name	John Smith
   Group	Remote SSL VPN group

6. Click Save.

Check authentication services

This example sets the user portal and SSL VPN authentication methods to local authentication. Sophos Firewall then acts as the authentication server.

1. Go to Authentication > Services.

2. Under User portal authentication methods, do as follows:

   1. Clear Set authentication methods same as firewall.
   2. Check that the Selected authentication server is set to Local.

   

3. Scroll to SSL VPN authentication methods.

4. Check that the authentication server is set to Local.

   

SSL VPN configurations

Specify the required SSL VPN settings, configure an SSL VPN policy, and, optionally, the provisioning file.

SSL VPN global settings

When SSL VPN clients connect to the firewall, it assigns IP addresses from the subnet you enter here. You must use a private address.

1. Go to Remote access VPN > SSL VPN and click SSL VPN global settings.

   

2. Enter the private IP address and subnet mask.

   When connections are established, the firewall leases IP addresses from the subnet to remote users.

   

3. Enter the following DNS settings:

   1. Enter the primary and secondary IPv4 DNS server addresses.

   2. For Domain name, enter the DNS suffix (example: company.com or test.local) for the hostnames of permitted resources.

      The suffix is added to the remote endpoint's network adapter. It's appended to hostnames forming an FQDN to resolve the endpoint's DNS queries.

   

4. Click Apply.

Add an SSL VPN policy

Create a policy that allows users in the remote SSL VPN group to establish VPN connections and access resources on the local subnet.

1. Go to Remote access VPN > SSL VPN and click Add.
2. Enter a name.
3. Select the policy members.

4. Turn on Use as default gateway to establish a full tunnel.

   All the traffic of remote users, including internet traffic, enters the firewall through the established tunnels.

5. For Permitted network resources that members are allowed to access, this example selects the following:

   • LocalSubnet

   • DNS_Servers

     To allow DNS resolution, you must select the DNS servers.

6. Click Apply.

   

(Optional) Create a provisioning file

The provisioning file automatically fetches the .ovpn configuration through the user portal. It also fetches some configuration changes you make later. See Provisioning file templates.

1. Open a new file in a text editor, such as Notepad.

2. Copy and edit the settings to meet your network requirements using the syntax on Provisioning file settings.

   You must specify the hostname or IP address of the gateway. The other fields are optional.

   Example

   [
       {
           "gateway": "203.0.113.1",
           "user_portal_port": 443
       }
   ]
   

3. Save the file with a .pro extension.

4. To install it on users' endpoints, use one of the following options:

   • Email the provisioning file to users.

     Users must click Import connection in the Sophos Connect client and select the file. Alternatively, they can double-click the .pro file to import it. See Remote access IPsec and SSL VPN.

   • Use an Active Directory Group Policy Object (GPO) to automatically import it to the Sophos Connect client on users' endpoints after start-up. See Import VPN provisioning file through GPO.

Allow traffic

You must allow SSL VPN from the WAN zone and configure a firewall rule to allow SSL VPN traffic.

Check device access settings

You must allow access to some services for remote users from the required zones.

1. Go to Administration > Device access.

2. Under SSL VPN, select WAN to allow remote users to establish SSL VPN connections.

3. Under User portal, select the following:

   1. WAN and Wi-Fi: Users can access the user portal from the WAN and Wi-Fi zones. They can then download the VPN client and configuration from the user portal. LAN is selected by default.

      Allowing WAN access is a security risk.

   2. VPN: After users establish a VPN connection, they can access the user portal through VPN. You can then turn off access from WAN.

4. (Optional) Under Ping/Ping6, select VPN.

   Users can ping the firewall's IP address through VPN to check connectivity.

5. Under DNS, select VPN.

   Users can resolve domain names using the VPN tunnel.

6. Click Apply.

   

Add a firewall rule

1. Go to Rules and policies > Firewall rules.
2. Select IPv4 or IPv6.
3. Click Add firewall rule and New firewall rule.
4. Enter a rule name.
5. For Source zone, select VPN.

6. For Source networks and devices, select ##ALL_SSLVPN_RW or ##ALL_SSLVPN_RW6.

   The firewall dynamically adds IP addresses leased to remote users who've established a connection to these hosts.

7. For Destination zones, select Any, to allow remote users' traffic from VPN to any zone, including LAN, DMZ, and WAN zones.

8. For Destination networks, select Any.

   The default gateway setting ensures remote users' internet traffic flows through the firewall. So, the firewall rule must allow traffic from the specified source networks to any network.

9. Click Save.

   Here's an example:

   

User actions

Users can download the Sophos Connect client from the user portal and install it. They can import the .pro file you provide or download the SSL VPN configuration and import it to the client. See Remote access IPsec and SSL VPN.