0

I configured incoming VPN connections on my Windows 7 machine and I want clients that connect to not be able to access computers and other network resources that are part of the same internal network. How can I do that?

My machine on which I configured incoming vpn connections is assigned the ip address 192.168.1.7. Another computer in the same local network has 192.168.1.2.

How can I make sure vpn clients do not have access to 192.168.1.2?

I already turned off network discovery so the resource such as 192.168.1.2 does not show but I can still ping and reach them. Is there a way to block access?

EDIT: I am aware I can do that via "IPSec Security Policy" but I like to do it on a user level, meaning, I want to block access to said IP address only for a specific user that logs in via vpn.

Thank you

1 Answer 1

1

This can be done on a per user basis, but on per Incoming Connection basis.

Once you create an Incoming Connection, deselect the check-box allowing access to local network on the Networking tab.

enter image description here

In order to strengthen the security,- enable local firewall on local machines. By default, it will block any incoming request.

4
  • This would probably also disable disable internet access I assume? And it is not on a user level, meaning if an admin wants to gain access via vpn he/she would not be able to access the network...not really what I am looking for. I need restricted access for specific users.
    – Matt
    Sep 21, 2015 at 13:06
  • This will not disable Internet access, just block access to LAN machines. You can configure 2 Incoming connections, with one allowing local access (for admins) and another one - blocking access (for users). Sep 21, 2015 at 13:12
  • Good idea regarding 2 different incoming connections. Thanks for that. But the internet connection (my dns and gateway is at 192.168.1.1) is not working on the vpn client side.
    – Matt
    Sep 21, 2015 at 13:57
  • As long as you have firewall enabled and you block everything except wha t you need, users connected via Incoming connection will not be able to access these machines on the network. You can also deny ICMP (ping) traffic. Sep 21, 2015 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .