0

I would like to set up an IPSec site-to-site tunnel between my company and an external company. (The external company does not support a dial-in mechanism, so I have to use a site-to-site VPN...)

I would like to access a device with address 1.1.1.1 from my network 172.16.0.0/16. I am not that a big expert with site-to-site VPN tunnels, but I guess I have to create a tunnel between 1.1.1.1/32 and 172.16.0.0/16. The configuration of that tunnel must be done on both tunnel endpoints. This has one big drawback: Internal details of my networking structure are revealed to the external company.

Is there a way to create a tunnel WITHOUT giving the peer all the details of my local network?

Does a site-to-site VPN connection make sense in this context? If so, how should they be configured? If not, what would be alternative solutions if I do not want do communicated in an unencrypted way?

Best regards, Tom

|improve this question
  • 1
    If you don't trust (won't to reveal your resources) to another end then what is the point to have tunnel? Any nowadays OS supports permissions. Create a group for external site and set permissions, what resources available for them and what is restricted. You can use OpenVPN to setup such bridge where you can use different subnet for OpenVPN clients, this way both sites can use different subnets schemes while VPN subnet may have its own subnet such as 10.1.2.0/24. – Alex Aug 21 '18 at 16:26
  • I only want to access one device in their network. They should not be able to access any devices in our network, neither should they get a hint on which IP addresses we use... – TomS Aug 21 '18 at 19:30
  • OpenVPN server on their side and OpenVPN client on your side, then on your side in firewall restrict inbound connections from external site. It easily can be done with pFsense – Alex Aug 21 '18 at 19:43
1

As an illustration of what can be done, consider:

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/69308-asdm-restrict-remot-net-access.html

Since the tunnel does of necessity broker every packet that passes through the tunnel in either direction, it can restrict what packets can be sent and what combinations of IP-addresses can be used.

And of course, "so can any firewall."

Site-to-site VPN is a logical strategy in your case, and it can often be implemented in hardware, at the router level.

|improve this answer
  • That means that I don't necessarily have to reveal my internal network structure to them... I just could use 0.0.0.0/0 as local subnet in the tunnel definition... I'll try that tomorrow. Thanks. – TomS Aug 21 '18 at 19:35

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.