Tutorial: Block Traffic Between VPN Clients
Control access between VPN clients connected to your server with Access Server's access controls.
Overview
Access Server includes a setting that allows you to block traffic between connected VPN clients globally. When this option is enabled, VPN clients can still access network resources you've granted, such as internal servers or services, but they can't directly communicate with each other.
This is useful for isolating users and reducing the risk of lateral movement within your VPN.
Tip
Administrators and designated users can be granted exceptions to this restriction. This tutorial explains how to configure those overrides.
An installed Access Server.
Configured user accounts.
Sign in to the Admin Web UI.
Click Configuration > Advanced VPN.
Under Inter-Client Communication, set Should clients be able to communicate with each other on the VPN IP Network? to No.
From the Advanced VPN page in step 1, under Inter-Client Communication, set Allow VPN users with Administrator privilege to access all VPN client IP addresses to Yes.
Sign in to the Admin Web UI.
Click User Management > User Permissions.
Click More Settings for the desired user.
Click the checkbox for Allow Access From all other VPN clients.
Tip
When enabled, this user can receive traffic from other connected VPN clients, overriding the global client isolation setting if it's in place.
The user is now configured to receive traffic from other VPN clients, even if global client isolation is enabled.