5

We have a Smoothwall firewall with both a "green" network (LAN) and an "orange" network (DMZ), and we would like to use OpenVPN access server as our VPN server.

The question is: Should the VPN server go in the LAN or the DMZ? And, if in the DMZ, then how should VPN-connected clients access LAN resources (e.g. a Samba share or Windows remote desktop)?

(I know that this should be a basic question, but I have spent a lot of time searching the web, and it appears that most people recommend to put the VPN server in the DMZ. However, it is not clear to me how one could access resources in the LAN from the VPN server without compromising the security principles of having a DMZ in the first place.)

Any responses would be much appreciated!

Edit: I cannot find any quality explanation about how to proceed on the web. Another suggestion (http://www.antionline.com/showthread.php?228254.html) is to put the VPN server in parallel to the firewall. To me, this sounds even worse then port forwarding into the LAN itself.

Improve this question
3
  • If, for this question, down voting means the answer is obvious, then please tell me!
    – Andrew Bate
    Jan 1, 2013 at 13:36
  • 1
    Both are possible. If you place vpn server at DMZ then allow required services only from vpn server to LAN.
    – Sarath kumar S
    Nov 8, 2015 at 11:27
  • 2
    This is an old question, but does not have a satisfactory answer. Disappointing the community considers this too "basic" to answer properly. That's what the the Stack Overflow communities are for.
    – Matt
    May 13, 2016 at 2:41

1 Answer 1

Reset to default
2

Your answer is in your question:

if in the DMZ, then how should VPN-connected clients access LAN resources...

Depending on what's your goal...

Putting VPN in your DMZ is something stupid as your DMZ is an advanced internet zone in your architecture.

Putting VPN in your LAN implie that you know what you do.

You could even build a kind of DMZ bis which have limited, monitored and controled access to your LAN and which don't be reachable from Internet. This require such an advanced firewall or two cascaded firewalls.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.