Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to setup a restricted external access to file shares on the network.

Thing is, there are some sensible files that require to be hidden when someone connects from the (eventual) VPN.

Setup:

Mac OS X server 10.5, up-to-date Open Directory + Samba + Kerberos Various windows and mac os clients, no older than XP or 10.5 as far as I've been told.

My idea, from the start, was to setup the VPN so that it will allocate IP addresses from another subnet, route the subnets together using the firewall, and block incoming access to some folders using Samba's rules, and let the system apply the relevant ACL for the remaining folders.

Is it possible to do such a thing using AFP share points, and combine all the greatness together from the potential VPN, Open Directory, and all, to prevent access from the outside? If so, how?

share|improve this question
    
The idea slightly matured as to downright forbid access to AFP from the VPN IP range, forcing outsiders to fallback to SMB... Any good you think? –  MrZombie Dec 22 '09 at 20:07

2 Answers 2

up vote 1 down vote accepted

We do exactly that. VPN clients are put on a subnet which is different from the AFP servers. They must go through a router, which has the ability to block port 548. We go one step further by defining two classes on VPN users based on a pre-shared key. We can then define rules differently based on the class of VPN user.

You don't really need to block it at the router though. You could also enable the firewall in Mac OS X Server and block it there.

If you only block port 548, then Samba/CIFS will continue to work.

share|improve this answer

If your VPN clients are on a different subnet to your LAN clients you should be able to use the built in Server Firewall to restrict AFP (port 548) access to the LAN subnet.

share|improve this answer
    
Then would the Mac clients still be able to use the SMB share as a fallback? –  MrZombie Dec 23 '09 at 13:44
    
The idea being that the clients still need to have access to some but not all of the shared folders. –  MrZombie Dec 23 '09 at 13:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.