Home  Prev  cOS Stream 4.00.02 Administration Guide  Next

Chapter 14: SSL VPN

cOS Stream provides an additional type of VPN connection called SSL VPN. This makes use of the SSL/TLS protocol to provide a secure tunnel between a remote client computer and a network behind the Clavister NetShield Firewall.

SSL VPN is configured in cOS Stream by creating an SSLVPNServer object which listens for SSL/TLS client connections on all or specific Ethernet interfaces and provides client access to a specific local network behind the firewall. The SSLVPNServer object is itself treated as an interface in the firewall configuration and can be referenced like an interface by other configuration objects, such as an IPRule.

The typical SSL VPN scenario is illustrated in the diagram below where a client running SSL VPN software has access to hosts on a protected local network behind a firewall.

SSL VPN

Figure 14.1. SSL VPN

Advantages of SSL VPN

A primary advantage of SSL VPN is that it can provide an encrypted SSL/TLS tunnel for traffic between a client and a network behind a firewall, using readily available client software.

A secondary advantage is that in many environments where roaming clients have to operate, such as hotels and airports, the network equipment may not allow another tunneling protocol like IPsec.

SSL VPN Client Software Requirements

The Clavister NetShield Firewall implementation of SSL VPN supports clients that are OpenVPN® compatible. A detailed discussion of client configuration is covered later in this section. (Legal notice: © 2002-2017 OpenVPN Inc. OpenVPN is a registered trademark of OpenVPN Inc.)

Minimum Supported SSL/TLS Version

The minimum supported SSL/TLS version of connecting clients for the SSL VPN feature is TLS version 1.2.

Summary of SSL VPN Setup Steps

SSL VPN setup requires the following configuration steps to be performed:

  1. Using SCP, upload the following certificates to cOS Stream:

    • A server certificate which will be sent to connecting SSL VPN clients during authentication. This consists of public and private key files.

    • Any certificate chain files which the client will need to authenticate the server certificate because it was signed by an intermediate CA.

    • One or more CA root certificate files which will be used to authenticate the certificate received from SSL VPN clients.

  2. A Certificate object should be created in the firewall configuration for each of the uploaded certificates. The Type property for each object will be Local for the server certificate and Remote for the others.

    The Certificate objects must be added as children of a CertificateStore object. The default store called ipsec could be used for this purpose but it is often better to create a new store and give it a name such as sslvpn. Any reference to a Certificate object must be qualified by the name of the store in which it is found. For example, sslvpn/my_ca_cert.

  3. Set up User objects in a LocalUserDatabase which have the username and password of connecting SLL VPN clients. A new LocalUserDatabase might be created just to only hold SSL VPN client credentials.

  4. Create an AuthenticationProfile object with its LocalUserDB property set to the database containing the credentials of the connecting clients.

  5. Create an address book IP object which specifies a range of IP addresses. This will act as a pool of addresses which will be handed out to clients.

  6. If client connections are only to be accepted from a specific IP range then define this range in an address book IP object.

  7. Create an SSLVPNServer object and configure, at a minimum, the following mandatory properties:

    • LocalEndpoint - The IP of the outer tunnel endpoint to which clients connect.

    • ServerCert - The SSL server certificate sent to the client.

    • ServerIntermediateCert - Any certificate chain needed with the server certificate.

    • ClientCACert - The certificate sent by the client must be signed by this certificate.

    • AuthProfile - The previously defined AuthenticationProfile object.

    • LocalNetwork - The protected network clients are allowed to access.

    • ClientIPAddresses - The IP address range to hand out to clients.

    • IPAddress - The IP address of the inner local tunnel endpoint.

    Other optional properties are discussed later in this section.

  8. Ensure that a route exists that routes the LocalEndpoint IP address on the core interface. This will already exist as a predefined route if the LocalEndpoint is set to an interface's default IPv4 address object. For example, ip_if2 is already routed on core for the if2 interface.

    Note that routes for client IPs will automatically be added as they connect and receive an IP address from the pool.

  9. Create an IPRule object that will allow traffic from the SSLVPNServer interface to the protected network.

  10. Make sure the SSL VPN client is correctly configured. Doing this is described next.

Configuring the VPN SSL Client

The following should be noted when configuring the SSL VPN client:

SSLVPNServer Object Properties

To configure SSL VPN, an SSLVPNServer object must be defined. The key object properties are as follows, divided up into mandatory and optional properties:

Mandatory Properties

[Tip] Tip: The inner IP address can be pinged

For troubleshooting purposes, an ICMP Ping message can be sent to the IPAddress property of the tunnel. However, in order for cOS Stream to be able to respond, an IP rule must exist that allows traffic to flow from the SSL VPN interface to core (in other words, to cOS Stream itself).

Optional Properties

The complete list of SSLVPNServer object properties can be found in the separate CLI Reference Guide.

Support For IPv6

There are no restrictions on the use of IPv6 with SSL VPN in cOS Stream. Either IPv4 or IPv6 can be used for all the IP addresses when configuring SSL VPN. It also possible to have both, with all IPV6 outside the tunnel and all IPv4 inside the tunnel or the other way around.

However, there may be restrictions imposed on IPv4 and IPv6 usage by the VPN client software selected and this should be checked by the administrator before configuring SSL VPN. The example below uses only IPv4 addresses.

Example 14.1. Configuring an SSL VPN Server

This example shows how to configure an SSL VPN server in cOS Stream that will provide secure access by connecting clients to a protected network behind the firewall.

The following assumptions are made:

  • The firewall's Ethernet interface if2 will be used to listen for client connections coming from the Internet and this has the public IPv4 address if2_ip. The address if2_ip is already routed on core so no route needs to be added for this.

  • Client connections will be made using SSL VPN to hosts located on the protected IPv4 network if3_net (10.0.0.0/24) connected to the firewall's if3 Ethernet interface.

  • The IPv4 addresses handed out to connecting clients will be come from the address range defined by the address book object ssl_vpn_pool which has the range 192.168.1.115 -> 192.168.1.120.

  • Only TCP connections will be allowed.

  • The internal local endpoint IPv4 address is 192.168.1.110 and this is defined by the address book object int_local_ip.

  • Authentication of client credentials will be performed against a new and separate local database of users that will be called ss_vpn_users.

  • A geolocation filter will be added so that connections will only be allowed from source IP addresses in a given location.

  • The appropriate SSL client software has been installed and configured correctly on the connecting client devices.

The diagram below illustrates the scenario which will be set up in this example.

Command-Line Interface

1. Upload the CA, server and any chain certificate files to the firewall using SCP.

2. Create Certificate objects for the uploaded files:

Create a CertificateStore for SSL VPN: 

System:/> add CertificateStore sslvpn
Add the Certificate objects as children of the store. First, the CA root certificate: 
System:/> cc CertificateStore sslvpn
System:/CertificateStore/sslvpn> add Certificate ca_cert
			Type=Remote
			CertificateData=file://ca_cert.cer
Then add the server's host certificate: 
System:/CertificateStore/sslvpn> add Certificate server_cert
			Type=Local
			CertificateData=file://server_cert.cer
			PrivateKey=file://server_cert.key
Optionally add any chain certificate that is needed because the host certificate was issued by an intermediate authority: 
System:/CertificateStore/sslvpn> add Certificate server_cert_chain
			Type=Remote
			CertificateData=file://server_cert_chain.cer
System:/CertificateStore/sslvpn> cc
System:/>

3. Create a LocalUserDatabase and add at least one user:

System:/> add LocalUserDatabase ssl_vpn_users
System:/> cc LocalUserDatabase ssl_vpn_users
System:/LocalUserDatabase/ssl_vpn_users> add User client1
			Password=someobscurepassword
System:/LocalUserDatabase/ssl_vpn_users> cc
System:/>

4. Create an AuthenticationProfile object:

System:/> add AuthenticationProfile my_auth_profile
			LocalUserDB=ssl_vpn_users

5. Optionally create a GeolocationProfile object:

System:/> add GeolocationFilter my_geo_filter
			Regions=EU
			MatchUnknown=No

6. Create an SSLVPNServer object:

System:/> add Interface SSLVPNServer my_sslvpn_server
			TransportProtocol=TCP
			AuthProfile=my_auth_profile
			ClientCACert=sslvpn/ca_cert
			ServerCert=sslvpn/server_cert
			ServerIntermediateCert=sslvpn/server_cert_chain
			LocalNetwork=if3_net
			ClientIPAddresses=ssl_vpn_pool
			LocalEndpoint=if2_ip
			IPAddress=int_local_ip
			SourceInterface=if2
			RemoteEndpoint=all-nets-ip4
			SourceGeolocation=my_geo_filter

7. Create an IPRule for the traffic inside the tunnel:

System:/> cc RuleSet IPRuleSet main
System:/IPRuleSet/main> add IPRule Action=Allow
			Service=all_services
			SourceInterface=my_sslvpn_server
			SourceNetwork=all-nets-ip4
			DestinationInterface=if3
			DestinationNetwork=if3_net
			Name=ssl_to_if3

Providing Internet Access Via SSL VPN

It is possible to provide Internet access to clients through an SSL VPN tunnel. Using the setup in the example above as the starting point, assume that the firewall's if1 interface is connected to the Internet and the network all-nets is routed on this interface in the configuration. The following steps are needed to give Internet access to SSL VPN clients:

SSL VPN Global Settings

The configuration object SSLVPNSettings object allows a set of global properties to be changed for all SSLVPNServer objects. They consist of the following:

Example 14.2. Changing an SSL VPN Advanced Setting

This example shows how to reduce the SSL rekey interval to 1800 seconds.

Command-Line Interface

System:/> set Settings SSLVPNSettings RekeyInterval=1800
Home  Prev   Next