Few days ago I was asking where to place the OpenVPN Access Server to provide network conectivity to LAN resources for remote users. While looking at the admin guide one of the few options is "One Network Interface on Private Network Behind the Firewall" In this configuration, it is required that the Internet Gateway be set up to forward desired TCP/UDP port traffic from the public IP to the Access Server‟s private IP address. At a minimum, one TCP port (typically port 443) needs to be forwarded. I know that ideally it should be placed in a DMZ. The firewall may need to be configured to allow traffic between the Access Server and the private network behind the firewall. But my question is, what type of security steps should I undertake to make the border router/firewall as secure a possible. I would have to configure port forwarding for port 4443 from the public facing interface to the 1918 IP assigned to that OpenVPN AC, and I know that even though NAT was never meant to provide security it somehow hides my LAN resources, but what else?
I highly appriciate any help.