m4nifest0-tech

Search the site

Networking and network segmentation

Remote access via VPN

Internal network access from outside only through a VPN, with key-based authentication and an optional site-to-site link between locations.
ActiveUpdated on

Objective

Reach internal services securely from away from home, without exposing management interfaces or services directly to the Internet.

Architecture

Only the VPN endpoint, hosted on the firewall, is reachable from the outside. Clients authenticate with key pairs and, once inside the tunnel, can reach only the management and server segments they are allowed to. A remote site can be linked in site-to-site mode through a dedicated permanent tunnel.

Remote access via VPNA remote client and, optionally, the gateway of a remote site reach the Internet and, from there, a firewall that hosts the VPN endpoint. The remote site link is a site-to-site tunnel, shown as a dashed line. After authentication, the firewall allows access only to the management and server segments of the internal network.External accessPublic networkPerimeterInternal networkRemote clientauthorized deviceRemote site gatewayoptional, site-to-siteInternetFirewall and VPNbuilt-in VPN endpointManagement VLANServer VLANVPN tunnelsite-to-siteVPN traffic onlylimited accesslimited access
  • Remote client is connected to Internet (VPN tunnel)
  • Remote site gateway is connected to Internet (site-to-site), logical link
  • Internet is connected to Firewall and VPN (VPN traffic only)
  • Firewall and VPN is connected to Management VLAN (limited access)
  • Firewall and VPN is connected to Server VLAN (limited access)
Remote access via VPN. A remote client and, optionally, the gateway of a remote site reach the Internet and, from there, a firewall that hosts the VPN endpoint. The remote site link is a site-to-site tunnel, shown as a dashed line. After authentication, the firewall allows access only to the management and server segments of the internal network.Solid line: direct connection. Dashed line: logical or secondary connection.

Details

Principles

No management interfaces or internal services are reachable from the outside: the only entry point is the VPN endpoint. Each device has its own key pair, which can be revoked individually, and once inside the tunnel it can reach only the authorized segments. Traffic leaving the tunnel is still subject to the firewall rules: the VPN authenticates and encrypts, but it does not replace the access policy.

A remote site can be linked in site-to-site mode, with a permanent tunnel and routes limited to the networks that are actually needed. The approach is described in WireGuard: remote access and site-to-site VPN without the complications.

Current setup

  • Solution: WireGuard, for its simple configuration and its performance compared with more traditional VPNs.
  • Routing: split tunnel — only the management and server segments go through the tunnel; the rest of the client's traffic leaves through its local network.
  • Name resolution: connected clients use the internal DNS resolver, so service names work just as they do on the local network.
  • Keys: each device has a dedicated pair; keys are rotated every 6 months, or immediately if a device is lost or retired, with the corresponding peer revoked right away.

What is not published

Addresses, ports, hostnames, and the endpoint configuration are not listed, so as not to make access attempts easier.