How to firewall Client connections to the internet thru a Windows Server VPN?

Question

I have a Windows Server 2008 R2 configured to provide internet access to Clients connected over VPN using the native RAS of Windows.

There is a need to block certain outgoing TCP ports from the clients on the server side, however, Windows Firewall on the server seems to only control connections attempted locally.

The client connections to the internet aren't even showing on the server using netstat -a

Even configuring Windows Firewall to block all outgoing traffic seems to take effect only on connections attempted by programs running on the server.

Is there a way to apply the server's firewall rules to the client connections being routed through?

Answer 1

It turns out the way to do it is not through the Windows Firewall.

In the RRAS settings there's the possibility to configure a stateless packet filter, but the control is very limited, and I couldn't specify a restriction to be applied to the VPN clients only. The ristriction would also get applied to applications running locally on the server (which is something I don't want). There is no way to specify an IP range (either all IPs, or just one specific).

---

Then I found out about the Network Policy Server (NPS, %windir%\system32\nps.msc). And there the control can be better refined. So I created a Network Policy like this:

So by restricting the policy to a certain Windows Group of users this has solved the issue properly.