How 2 deny all but VPN frm remote site ?

I have several remote sites that connect via VPN to corporate via various broadbands ( DSL, ISDN, Cable ). Problem is the locals are getting into trouble by surfing when not using VPN through the ISP.
Would a solution be to shut down all ports save the VPN and would that allow them to continue to surf but forced through the corporate firewall ? Using Cisco. Suggestions for local firewall ( at remote site ) appreciated. Currently using a LinkSyS but it appears too Mickey Mouse for any detailed control.
Thanks,
Mike

I use a linksys for this purpose. I use it to block all outbound except port 1723 and have the users log into the vpn by a "dialup" login, (it's still DSL but M$ insist on calling it dial up). It works fine for me - no problems from the users, they are still limited by my surfing controls and policies etc. and they get what they need.

Haven't gotten too into vpn yet, but can't you configure most browsers to only use specific connections? vpn connections are considered separate connections by the os usually right? if not nevermind.

you could set up a proxy at corp and set all the remotes to use it. not olny would you be forcing them threw your filewall but a record will be kept of their surfing. a deterrant in itself

het TS! could you please go into a little more detail on that

You could always setup a pure site to site VPN tunnel. It always on, users have no way of exiting the tunnel as they don't use a software client. It's all taken care of in hardware. IT's possibly cost prohibitive if you've already got stuff in place.

How exactly is the general setup now? A little more info would help.

And yeah as usual Tigershark is correct my only concern would be bandwidth, it could be an issue as to what your remote users are doing. I've had engineers try to transfer some rather large files via perforce and it took forever and a day. Always try to do what can in hardware first, only use software when there is no other choice. IMHO.

peace

Thanks all for the swift replies. Been out of town. Onto another fire. Will reply back with particulars as fog clears.
Mike

Quote:

---

Originally posted here by Mv513
I have several remote sites that connect via VPN to corporate via various broadbands ( DSL, ISDN, Cable ). Problem is the locals are getting into trouble by surfing when not using VPN through the ISP.
Would a solution be to shut down all ports save the VPN and would that allow them to continue to surf but forced through the corporate firewall ? Using Cisco. Suggestions for local firewall ( at remote site ) appreciated. Currently using a LinkSyS but it appears too Mickey Mouse for any detailed control.
Thanks,
Mike

---

Kind of depends on how you have your VPN setup. If you are using IPSEC/ike you deny all outbound access except protocol 50/udp 500. I doubt your LInksys will let you do that, so you could setup your concentrator/vpn to use tcp/10000 instead of protocol 50, and your linksys should be able to filter on that.

As far as recommendations, for small remote locations, we have used pix-501s and for 40 or so people we have been using pix-506. They are also able to be configured to use a pure site-to-site VPN configuration...

Hope that helps steer you in the right direction...

I just heard that traffic acceleration has a part of the equation. It's a form of QoS (quality of service). Where you give priority for a given traffic. With an ISP data congestion links those packets will have priority over other traffic. ISPs use QOS on port 80 or 443. However if you encapsulate your traffic in to port 10000 you lose the priority, which falls under the "best effort" - it will get there whenever it will…This is where the slowdown occurs.
Any thoughts on this ?

Neb: Yep, a Linksys can do that. I filter all ports 1-1722 and 1724-65535 on my linksys and force all my users there to create the VPN tunnel to log in. After that they fall back under my control..... I like control..... :D

Looks like HQ is pushing a $1500 Cisco 3200 + C2940 switch solution. 'Course they're not footing the bill.

Mv:

Quote:

---

Looks like HQ is pushing a $1500 Cisco 3200 + C2940 switch solution.

---

Hmmmmm.... Could cost them less than $100.

Quote:

---

'Course they're not footing the bill.

---

That might explain all things

Then tell them to buy Timestep VPN boxes. They are obscure enough so that no one will know how to break into them and they have the highest performance ratings as far as VPN concentrators go.

If they don't care about cost then that will "Wow" them for sure.

hehehe

Cisco VPN's aren't that great.