OpenVPN to VLAN

[guest39556]

I am looking to set up a VPN server that will allow me to access my VLAN for my server from my local network (i.e. I want to be able to use the VPN only when im on my local network). Is there a guide or process for setting this up?

[bartjsmit]

You need to unpick your requirements:

"allow me" - is a firewall rule which is on layer 3 i.e. between IP addresses/subnets.
"my VLAN for my server" - is a layer 2 separation device which usually matches a subnet.
"my local network" - is a group of subnets or a single subnet.
"a VPN server" - indicates yet another subnet in the form of a tunnel.

Subnets communicate with each other through routers:

LAN subnet -> OPNsense router/firewall -> VPN subnet -> VPN Server -> Server VLAN subnet

The first bit is out of the box and therefore easy. The second leg is a VPN tunnel to your VPN server. The rest is unclear. Are you running the VPN from "my server" or is there a device in between? If so, what is that device?

Draw a diagram for yourself and add VLAN numbers, VPN names and IP subnets. Ensure that there are routes from the client to the server and from the server back to the client. Add an attacker to the diagram as a second client that should not have access. Formulate firewall rules to allow one and deny the other client.

If you can't work that out, share the diagram here with your thoughts and indicate where you get stuck.

Bart...

[guest39556]

Im not sure I understand what youre saying. I have a device on my LAN (192.168.1.0/24) that I want to talk to another device on my VLAN (192.168.150.0). I dont want this line to be open all the time, which is why I assumed setting up a local VPN would be an option. Is this the right approach?

[Saarbremer]

If you don't trust yourself and your local, yes a VPN may be an option. But actually, you'd have to set up a server on the target host itself.

But jokes aside: You just may want to add a pass rule on the LAN interface to allow traffic with destination in the VLAN network for the intended traffic. To limit its usage you might switch on/off your rules manually or on a schedule.

[guest39556]

I may consider doing that for the server host, I would like to keep this machine entirely isolated from my LAN since it will be hosting public facing web services. Thanks for the idea!

[Patrick M. Hausen]

I permit public facing servers access to the Internet but not to my internal LAN or other local networks.
I permit my internal LAN full access to these public facing servers.

Why not? Which problems do you expect or which attack vector? I'm "old school". I believe in zones with different levels of trust and a strict order. But why would I allow my desktop system access to "the server" via SSH only at certain times or only via VPN?

[guest39556]

wouldnt having the LAN be able to access the VLAN nullify the point of segregating the networks? maybe im misunderstanding but if the vlan and lan can talk to each other, is there any separation?

[Patrick M. Hausen]

The LAN is trustworthy. The server network is not. So the server network can never initiate a connection to the LAN. But the trustworthy LAN can initiate a connection to the server network any time.

Firewall policies are uni-directional in most cases.

[Saarbremer]

wouldnt having the LAN be able to access the VLAN nullify the point of segregating the networks? maybe im misunderstanding but if the vlan and lan can talk to each other, is there any separation?

The reason behind network segmentation is to reduce the attack surface dramatically: You allow only those services that are supposed to happen. Yes, an attacker having credentials for your SSH or is able to explot a security issue is not withold by the firewall. However: An attempt to access e.g. SMB/CIFS shares is rendered impossible.

That way you only need to make sure SSH services are secure and safe (up-to-date, adequate credentials' strength, matching certificates, allowed users only, ...)

No VPN will help you with that.

Always keep in mind that a

firewall / VPN / (arbitrary security measure with or without intelligence) / correct service configuration /  application layer gateway / ids / ips / dns bl / ....

can only be a puzzle piece of your IT's security and should match your requirements.