Tutorial: Create a DMZ in Access Server⁠

Overview⁠

An Access Server demilitarized zone (DMZ) uses network address translation (NAT) to forward requests from a private or public IP address on the Access Server to a connected VPN client. The idea is to provide an external static IP for a service running on a VPN client in an internal network. Requests made from an IP address managed by the Access Server can be forwarded to a service running on the VPN client.

This tutorial describes the two ways to configure a DMZ in the Access Server: via the web interface or via the command line.

In this example, we forward traffic on TCP port 80 on public IP 192.0.2.10 on the Access Server to a particular VPN user.

Sign in to the Admin Web UI.
Click User Management > User Permissions.
Locate the user you want to configure DMZ for and click the icon, More Settings.
Under DMZ Settings, click Yes for Configure DMZ IP address.
Enter the IP address and TCP or UDP port. For example, 192.0.2.10:tcp/80.
Select Save Settings and Update Running Server.

For more information about the User Permissions page, refer to User Permissions.

Like the example above, we will forward TCP traffic on port 80 on public IP 192.0.2.10 to a particular VPN user.

The config key dmz_ip.n in the user properties database defines which IP on the VPN server side must forward connections to this particular VPN user. The n indicates it is iterable, meaning you can specify multiple such records for a user. It starts with 0 and counts up from there. The key value is expected in the format of ip:protocol/port. In the examples below, this will become clear.

Connect to your console and get root privileges.
Switch to the scripts directory:
```
cd /usr/local/openvpn_as/scripts/
```
Forward incoming port TCP 80 on 192.0.2.10 to the user:
```
./sacli --user <USER> --key "dmz_ip.0" --value "123.45.67.89:tcp/80" UserPropPut
./sacli start
```
- The DMZ rule is now operational for TCP port 80. If an HTTP server runs on that VPN client, you should now be able to access http://192.0.2.10 in your web browser, even outside the VPN system.
- To remove the rule, delete its relevant key:
```
./sacli --user <USER> --key "dmz_ip.0" ConfigDel
./sacli start
```

Implementation Notes⁠

Both the source and destination IP addresses are routed with NAT. The destination address of incoming packets is translated to the VPN IP address of the client. The source address is translated to the VPN gateway IP address of the first OpenVPN daemon of the Access Server. This means assuming a default configuration of 172.27.224.0/20 for the VPN subnet, the packets will have source IP 172.27.224.1.
The DMZ IP address can be any IP address that is on a network interface on the Access Server. When you specify a DMZ IP address with a specific protocol/port defined, only the traffic directed to that protocol/port is routed through. This means that if the DMZ IP address is also bound to an interface on the server, that interface can still handle other traffic.
Specifying an IP address only for the DMZ value will redirect all ports to the VPN client. Be aware that if you do this on the IP used by the Access Server itself for its web and VPN tunnel daemons, you would effectively be cutting yourself off from access to your Access Server. You should only do this on secondary IP addresses, not the primary IP address.
Clients connected to the VPN with reroute_gw defined can access a DMZ IP address through the tunnel.
A DMZ IP address works with a VPN client that uses either a static or dynamic VPN IP address.
Access Server ensures that clients don’t declare conflicting DMZ IP addresses.
A DMZ on Access Server heavily uses the iptables SNAT, DNAT, and MARK modules.
A DMZ on Access Server is subject to NAT limitations, and won’t work with protocols that have problems with NAT like SIP.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: Create a DMZ in Access Server⁠

Overview⁠

Implementation Notes⁠

Was this information helpful?