Tutorial: Set Up an IP Allowlist Using Access Server's Split Tunneling Functionality for Enhanced SaaS Security⁠

• An installed Access Server.

• A public static IP address.

• Access to SaaS application(s).

• Basic networking knowledge (familiarity with NAT and IP addressing).

• Admin Web UI access.

Follow the steps here to achieve two main objectives:

1. Ensure only traffic to specific SaaS applications traverses the VPN while all other internet traffic remains unaffected.

2. Set up an allowlist of source IP addresses at the SaaS provider, allowing access through Access Server's public IP address using NAT.

To configure NAT for Access Server:

1. Sign in to the Admin Web UI.

2. Click Access Controls.

   • The Group and User Access Rules tab displays.

3. Click the Global Access Rules tab.

4. Set Reachable via to NAT (default setting).

5. Specify the IP address in the Subnets field.

   • For example, enter the IP range provided by Salesforce when setting this up with Salesforce. Check regularly for updates.

6. Click Save.

7. Click the Internet Access and DNS tab.

8. Set Internet gateway to Split-Tunnel.

9. Set Push DNS is Off to prevent pushing DNS settings.

10. Click Save and Restart.

Follow these steps for the SaaS account you want to secure (using Salesforce as an example):

1. Sign in with an administrator account.

2. Select the Setup icon.

3. Select Users → Profiles.

4. Select the profile for access (e.g., "End Users").

5. Select Login IP Range(s).

6. Select New to define the IP address.

7. In both the Start IP Address and End IP Address fields, enter the public IP address of your Access Server.

8. Provide a description and select Save.

9. Repeat for any additional profiles as needed.

   • Now, when a user attempts to sign in from an IP address that isn’t connected to Access Server, they will receive an error message indicating access is denied. Conversely, users connected to Access Server will successfully sign in as their traffic appears to come from the allowlisted IP.

Enhancing security layers for your business’s SaaS solutions can significantly mitigate risks, particularly those stemming from human error. By implementing IP allowlisting as outlined in this guide, you can ensure that VPN clients connect securely to your SaaS solution from anywhere.

The encrypted VPN connection safeguards users on public Wi-Fi, and using NAT allows you to allowlist Access Server’s IP address easily. This setup means users can connect securely from any location, as long as they are connected to your Access Server. For more information on using NAT with Access Server, refer to this resource:

• NAT and Routing