I'm trying to create a design for a secure machine, basically a Microsoft PAW, however this machine needs a VPN for use while in a home office. It will essentially only be a "clean-source machine" to further remote to a VM with tools within the work location.
- The PC is to be used for doing admin tasks on on-premise servers by RDP'ing to a virtual admin-desktop as a jump host.
- The PC should NOT reach ANY online service. ever... (updates it should get from WSUS and other services in the on-premise network after its connected).
- VPN server will be placed behind the same firewall as the virtual desktop.
- User of the PC will be normal user only, with no local admin rights.
- Users have the skills to take shortcuts (if found) to bypass security measures.
Q1: What VPN software (server/client) would you recommend to be installed (maybe preferably as a service on the client), to create an always-on connection?
Q2: Are the proposed solution safe from user tampering? I.E. would the user be able to change configuration files etc. and gaining access to other servers of similar server software?
Q3: Is using the Windows Firewall as a"Kill-switch" or "Lock-Down" a workable way to go, if blocking everything except the VPN software exe, or maybe better, the IP to the VPN server?