WEBVTT 00:00:01.940 --> 00:00:04.680 All right, and I'm going to keep my credentials the same. 00:00:04.690 --> 00:00:06.640 Going to use my joeadmin account, 00:00:06.650 --> 00:00:09.460 and this is not configured in the local firewall users. 00:00:10.540 --> 00:00:12.270 Oh, and it looks like we connected. 00:00:12.270 --> 00:00:17.260 We have an IP address of 192.168.32.3, which is in that scope. 00:00:17.940 --> 00:00:23.960 And as you can see right here, we have our OpenVPN adapter with that address. 00:00:24.830 --> 00:00:31.790 And now remember previously how we weren't able to connect to the firewall GUI, 00:00:31.790 --> 00:00:37.360 and now we do have our connectivity here. 00:00:38.340 --> 00:00:39.950 And let's refresh our firewall rules. 00:00:39.950 --> 00:00:42.480 And now you can see we have this OpenVPN one, 00:00:42.490 --> 00:00:45.160 and there's nothing being allowed here. 00:00:45.170 --> 00:00:49.320 So what this means is that we need to create rules 00:00:49.330 --> 00:00:51.740 similarly to how we did in the previous demos, 00:00:51.740 --> 00:00:55.150 segmenting our management and user networks to allow 00:00:55.150 --> 00:00:57.060 traffic for these VPN networks. 00:00:57.640 --> 00:01:01.560 So let's create an allow IP any rule real quick, 00:01:02.740 --> 00:01:05.050 which is not a best practice for security, 00:01:05.050 --> 00:01:06.760 but as you can see, 00:01:06.770 --> 00:01:09.950 we now have access to Google after I hopped back over to my 00:01:09.950 --> 00:01:11.970 Windows box that's connected to the VPN. 00:01:13.140 --> 00:01:14.280 So this is awesome. 00:01:14.290 --> 00:01:18.560 We successfully authenticated and established a remote access VPN. 00:01:19.640 --> 00:01:23.450 If you look in the User Manager, there's no internal users here. 00:01:23.840 --> 00:01:27.190 And again, to double‑check the actual VPN, 00:01:27.200 --> 00:01:31.160 we're using the GloboDC as the back end for authentication, 00:01:31.160 --> 00:01:32.860 not the local database. 00:01:33.940 --> 00:01:36.930 So now the only thing that we have left to do is to configure 00:01:36.930 --> 00:01:40.070 our firewall rules for that VPN connection. 00:01:40.070 --> 00:01:43.970 We don't want to leave it wide open, we don't want to permit any anyone. 00:01:43.980 --> 00:01:45.660 So let's go ahead and delete that. 00:01:46.240 --> 00:01:49.600 And I'm going to go ahead and speed up the video while I'm creating all 00:01:49.600 --> 00:01:52.660 of the firewall rules that we want for the VPN access. 00:02:00.040 --> 00:02:00.350 Okay, 00:02:00.350 --> 00:02:05.220 now that we have those basic firewall rules for our VPN connection configured, 00:02:05.840 --> 00:02:10.139 we should be good to go, and our VPN users should have basic access. 00:02:10.139 --> 00:02:14.000 Let's go double‑check that we still have access to Google. 00:02:14.000 --> 00:02:15.980 And actually, 00:02:15.980 --> 00:02:18.520 let's change this to a different service just to make sure 00:02:18.520 --> 00:02:21.650 that we're not caching any web pages, and there we go. 00:02:27.120 --> 00:02:27.500 And now, 00:02:27.500 --> 00:02:32.540 similarly to how we talked about earlier with creating these 00:02:32.540 --> 00:02:37.010 rules to allow access to only specific services in the 00:02:37.010 --> 00:02:38.940 management network and everything like that, 00:02:38.940 --> 00:02:42.490 what we're going to do is go through and configure all of these 00:02:42.490 --> 00:02:44.760 rules for a specific source and destination, 00:02:44.760 --> 00:02:46.780 and I'm going to speed up the video again to do that, 00:02:46.780 --> 00:02:49.350 and then we'll talk about some of those nuances after. 00:02:50.140 --> 00:02:54.670 Okay, now that we're done configuring those rules a little bit more specifically, 00:02:54.680 --> 00:02:55.830 let's talk through them. 00:02:55.840 --> 00:02:57.310 So, as you can see, 00:02:57.310 --> 00:03:00.860 I went ahead and created that rule not allowing 443 00:03:00.860 --> 00:03:04.180 traffic over to the management network, and later on, 00:03:04.180 --> 00:03:07.780 I'll go through and do it with other services like port 80 00:03:07.780 --> 00:03:09.660 as well and ones that we don't need. 00:03:10.130 --> 00:03:14.960 We have our DNS requests now going specifically to our DNS 00:03:14.960 --> 00:03:19.120 server internally from this OpenVPN connection. 00:03:19.490 --> 00:03:22.720 LDAP, same, it's only going to our domain controller. 00:03:22.850 --> 00:03:23.850 So as you can see, 00:03:23.850 --> 00:03:28.590 these rules are even more specific now than the ones on the user interface, 00:03:28.590 --> 00:03:30.750 so we can be more restrictive. 00:03:31.640 --> 00:03:36.230 And so the goal with both the segmentation and remote access service 00:03:36.230 --> 00:03:41.170 restrictions is so we can properly segment our network and create 00:03:41.170 --> 00:03:45.890 these firewall rules so that we have less network traffic that's 00:03:45.890 --> 00:03:50.040 going to the different segments, logging for whenever those connections happen, 00:03:50.040 --> 00:03:54.780 and then also so that we can better secure these services and 00:03:54.780 --> 00:03:56.680 the network functions that we're providing. 00:03:56.690 --> 00:04:01.210 So we wouldn't want our host connecting to any DNS servers 00:04:01.220 --> 00:04:04.290 outside of the ones that we host if that's, 00:04:04.300 --> 00:04:07.080 you know, our organizational policy or our intentions. 00:04:07.640 --> 00:04:13.730 So we want to button up and only allow the services to the specific destinations 00:04:13.730 --> 00:04:17.100 that are hosting those services as much as we can control. 00:04:17.110 --> 00:04:17.500 Remember, 00:04:17.500 --> 00:04:22.280 configuring your firewall to open up the rules for allowing specific services 00:04:22.280 --> 00:04:26.850 and stuff like that is a really good security posture to have, 00:04:26.860 --> 00:04:29.980 and it's difficult to do if you're not aware of all the 00:04:29.980 --> 00:04:32.810 applications and services that you see across the network. 00:04:32.840 --> 00:04:35.170 So after you initially configure these, 00:04:35.280 --> 00:04:38.610 then you'll have to field the requests for ports being 00:04:38.620 --> 00:04:40.510 opened or protocols being opened, 00:04:40.560 --> 00:04:43.360 and specific source and destination traffic being opened up, 00:04:44.040 --> 00:04:47.190 or have a list ahead of time to create these rules with 00:04:47.190 --> 00:04:49.570 and then tweak and tune it as needed.