3

In a VPN LAN-to-LAN setting, is it possible to isolate one site from the other?

I know that we can use a firewall but that would obligate us to manage specific rules in the firewall. I would like to reduce management workload. Do you think that a firewall would be the best solution?

We think that a LAN-to-LAN VPN is the best solution but maybe not. The need is to connect to a cloud IaaS server through the Internet but:

  • We want the communication to be encrypted always, probably using unencrypted protocols
  • We want that some services in the server to be available only to our IPs

In other words, we don't want the remote LAN to have complete access to the local LAN...the setting we are looking for is similar to the navigation to Internet: local machines exit to Internet using the same public IP and from Internet is not possible to initiate a connection to a internal machine because they have local IP addresses that are not addressable from Internet. In this way, local machines are isolated from Internet because the NAT and not existing forwarded ports.

Improve this question

1 Answer 1

Reset to default
2

A LAN-to-LAN VPN connection is just a bridge between two remote networks. You can think of it as a cable.

On top of that cable, the VPN routers usually provide a gateway to the other network. Without this gateway the traffic could not go though as packets from one network would not know how to reach the other network. It is reflected in the routing tables of the devices in each of the networks.

So you now basically have an open extension of one network into the other one. Each device on one network can reach to each device on the other one.

But this is not what you wanted - you wanted to restrict this traffic. Therefore you need to have some kind of filter which will allow some packets and not some others, based on some rules. This can be done by a firewall or you can check if your VPN gateway does not provide such functionality (look for "firewall" or "ACL" in the documentation).

You can further shape the traffic the way you want, including NAT (on both sides if required, to reproduce the Internet scenario you mention).

The key point here is that the VPN setup does not offer (at its core usage) nothing more than a secured communication layer between two networks.

Improve this answer
3
  • I don't fully agree with the affirmation that without two-way gateway functionality "packets from one network would not know how to reach the other network". For example, when you navigate from an internal machine with an internal IP through a router to an Internet host (NATing the public IP address to the internal IP address) that gateway functionality is not provided and communication happens. In this setting only the internal machine can initiate the connection and not the Internet server. That's a limitation but it is also what I would like to accomplish with a VPN.
    – Eloy Roldán Paredes
    Nov 6, 2015 at 15:05
  • 1
    The gateway does not have to be 2-way. This is a matter of routing. In the routing table of the hosts (on one, the other, or both sides) you would have an entry stating that "for this an that network (the remote one), here is where you need to send them". One of the gateways in your routing table is the default one (though from the description of your setup it is not likely to be the VPN box)
    – WoJ
    Nov 6, 2015 at 15:25
  • If you combine SNAT and DNAT rules in the right way you can even do it with no route table entries set at all (not that I would generally recommend this)
    – Peter Green
    Mar 1, 2016 at 1:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .