Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our corporate laptops are restricted to only allow internet access through our proxy (connection profile in Internet Explorer pushed through a GPO). On a remote/3rd party connection this is allowed by creating a VPN back to the corporate network (Cisco VPN Client -> Cisco ASA), at which point the proxy is available and we route all internet traffic through that.

We have recently had the question raised by one of our users who was attempting to use a Wireless connection on a train. The train company requires that the user fills in a form hosted on their own network.

The problem we had was that the user wasn't able to get to the train companies internal page as the proxy wasn't available. They couldn't connect the VPN as they hadn't completed the train companies logon page.

We considered that we could specify this page in the 'bypass proxy for this address...' which would allow a connection to only that page, this was rejected as we would then have to start adding every train company, hotel, public hotspot that works in this way (which must be a list of thousands)

Second suggestion was to allow connections to any local network range (10.* or 192.*) but the implications with regards to security seemed to dangerous. Plus the page offered up by the train company would be http://virginrailwifisignup page and not http://192.168.1.1

At which point we were stumped. The now familiar cry went up in the office "we can't be the only ones who have had this problem" but I haven't been able to find anyone who has mentioned a useful solution.

So I ask you, Server Fault, how have you managed this?

Worth noting, we provide all our mobile users with 3G connections for when they are out and about, they VPN back in over that but its flaky as hell on a train.

share|improve this question
    
Are you an end user or do you manage the VPN/network systems described above? –  Chopper3 Jan 18 '12 at 11:51
    
@Chopper3 I'm the administrator –  Patrick Jan 18 '12 at 11:54
    
What proxy server are you using? –  Tim Brigham Jan 18 '12 at 12:43
    
@TimBrigham We have a sophos web appliance - WS1100 –  Patrick Jan 18 '12 at 14:08
add comment

3 Answers

up vote 4 down vote accepted

Our corporate laptops are restricted to only allow internet access through our proxy (connection profile in Internet Explorer pushed through a GPO).

Pushing settings to a connection profile in IE, you don't only allow internet access through your proxy. You just make a notion about internet access through your proxy, and increase accessibility.

If I understand correctly what you want is to have users connect to your VPN in order to access the internet thus using your proxy. If that's the case you have to be carefull because now all potential malware/attacks get routed through your network.

By default in most Windows after XP when you connect to a VPN you are using the default gateway on the remote network. Thus you have to ensure that this setting stays like this. You can accomplish that through your GP or CMAK or by a script or by even doing it manually as a leveraged user once for every machine.

But on web-based logins your users have to access some random website (and thus the internet) ! This is where the Network Location Awareness kicks in

The Group Policy client will apply policy settings whenever domain controller availability returns. Examples of connection events that trigger Group Policy processing include establishing VPN sessions, recovering from hibernation or standby, and the docking of a laptop. This benefit can potentially increase the level of security on the workstation by more quickly applying Group Policy changes.

So if your user establishes a connection to a network other than your work network you will trigger your VPN connection and all is good.

I have to admit not an easy job especially when there is client diversification.

The other way of going around it is locking everything down disabling the lot of it and making another user account for usage outside your VPN and forcing other kinds of limitations (e.g. no videos,audio,specific domains,etc.)

Yet another way is to block certain ports from a specific connection or limit the access to your VPN e.g. no access to internal servers

share|improve this answer
    
Thanks, this is the kind of thing I was looking for. I think it still comes down to, at some point, allowing usre access to an untrusted site which is something we will need to reveiw internally (and I suspect reject). I'm currently reviewing our builds anyway so I'll stil NLA on my list to consider. –  Patrick Jan 18 '12 at 17:00
add comment

I guess I'm a little confused but why must all of your clients, when outside of your brick and mortar, be forced to connect to the internet only to get routed back through your own network?

I get having a VPN client to be able to call home and access resources on the network but why do you want all of their browsing traffic sent back to you just to be routed back out again? Is it for content filtering purposes or simply so they may also be able to access corporate resources.

Regardless, I guess I'm just a little confused on why the setup needs to be like this in the first place. If they aren't on your network why bother with proxying them back to the office if in fact they also have a VPN client? I guess I'm curious if the whole thing may be a little over complicated, over engineered if you will.

share|improve this answer
    
Our client is a subject to PCI. I'm not an expert but various PCI tests have found flaws with having end users with access to general wifi. I believe one of the earliest failures was that the pen testers setup an AP called "[Client]Wifi", end users connected and were presented with 'Enter user username/password'. There are other concerns with access to webmail systems from corporate laptops as well. In the end forcing all connections from all locations through VPN gives us the right tick marks on the PCI compliance form whilst still allowing remote access. –  Patrick Aug 30 '12 at 9:32
add comment

Use a real firewall to restrict access - not just the MSIE connection profile.

share|improve this answer
    
Could you provide any further info as to how this would work. All clients have a Trend Firewall that comes as part of the AV but in testing (another admins not mine so I don't know the detaiuls) it was identified as being not worth enabling. My argument would be that the situation is, basically, you allow access to untrusted web pages without the proxy or you don't. I don't see how a client firewall would be intelligent enough to differentiate beetween a valid Virgin Trains signup page vs some dodgy site. The proxy is a managed appliance which ew rely on for that very service. –  Patrick Jan 18 '12 at 14:10
    
I might add that I am aware that the IE connection profile isn't a particularly amazing way of managing this but its what we have and at the moment time is limited so we have to pick our fights. This isn't one we would prioritise over everything else right now. –  Patrick Jan 18 '12 at 14:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.