locked
How to restrict network access through NPS RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello All

    I have a dial in server, running server 2008. It successfully works using RRAS and NPS.

    I need to add a security measure. I need to restrict network access, so that only the internet works and nothing else. Essentially I do not want users being able to access and hosts on the LAN.

    any help would be appreciated.

     Thanks

    Monday, September 17, 2012 3:06 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    There are two ways to restrict access for VPN clients. One is to use NAP with remediation server groups. The other method can be used with NAP or without it and involves configuring IP filters.

    All you need to do is add an IP filter to the network policy that is matched by your VPN client when they enter the network. You can set the filter to allow access to a certain network, or to deny access to a certain network. Below is an example of how to deny access to the entire 10.0.0.0/8 network. You do not need NAP for this.

    If you really want to use NAP, you will not be able to use Group Policy for this because you are restricting access to the internal network. The internal network contains the domain controller that deploys Group Policy. You can configure these settings locally on each client computer, or you can just use IP filters instead as shown above.

    -Greg


    P.S. Theoretically there is also another way to restrict access, by supplying a pool of IP addresses from the VPN server that has no route to the internal network, but has a route to the Internet. This is a strange thing to do however because VPN clients typically already have access to the Internet, so there would be no reason for them to connect to the VPN... unless these are internal clients.
    Tuesday, September 18, 2012 7:41 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Thanks for your question.

    You may consider to deployment the NAP enforcement for VPN connection. If the VPN client does not meet the security requirements, it will only get restricted network access.

    For more detailed information, please refer to the following articles.

    NAP Enforcement for VPN

    http://technet.microsoft.com/en-us/library/cc753622(v=ws.10).aspx

    VPN Enforcement Example

    http://technet.microsoft.com/en-us/library/dd125309(v=ws.10).aspx

    Step-by-Step Guide: Demonstrate NAP VPN Enforcement in a Test Lab

    http://www.microsoft.com/en-us/download/details.aspx?id=5536

    Best Regards,

    Aiden

    Aiden Cao

    TechNet Community Support

    Tuesday, September 18, 2012 8:12 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks for the help. I am almost there. I have NAP working. I can tell, because once I force it through NAP in NAP Enforcement under the network polices it stops the connection. 

    I keep hitting one last road block. The client is always reporting Not NAP-capable.

    I have been through many many sites today, working on this, and I have everything correct.

    The client NAP service is started. Also, been through all the enforcement stuff and connection policy stuff. 

    The only way I could get the enforcement stuff on the client to displayed enabled was enabling it on the client computer.

    The odd thing is that the netsh nap client show grouppolicy is always blank. It is like the group policy is not coming down when the connection is made.

    Any ideas? 

    Tuesday, September 18, 2012 3:21 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    There are two ways to restrict access for VPN clients. One is to use NAP with remediation server groups. The other method can be used with NAP or without it and involves configuring IP filters.

    All you need to do is add an IP filter to the network policy that is matched by your VPN client when they enter the network. You can set the filter to allow access to a certain network, or to deny access to a certain network. Below is an example of how to deny access to the entire 10.0.0.0/8 network. You do not need NAP for this.

    If you really want to use NAP, you will not be able to use Group Policy for this because you are restricting access to the internal network. The internal network contains the domain controller that deploys Group Policy. You can configure these settings locally on each client computer, or you can just use IP filters instead as shown above.

    -Greg


    P.S. Theoretically there is also another way to restrict access, by supplying a pool of IP addresses from the VPN server that has no route to the internal network, but has a route to the Internet. This is a strange thing to do however because VPN clients typically already have access to the Internet, so there would be no reason for them to connect to the VPN... unless these are internal clients.
    Tuesday, September 18, 2012 7:41 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello, the IP filtering do nothing, I have test with a full network, still can PING and access share and even remote desktop.
    Wednesday, September 13, 2017 3:42 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Make sure that the client is matching the policy you created.

    Wednesday, September 13, 2017 4:08 PM