Configuring security groups and ACLs for use with a VPN server

Rules for VPN protocol traffic

VPN servers can run on TCP or UDP protocols. You can specify the protocol and port when you provision the VPN server. You must open the corresponding protocol and port with the security group rules and ACL.

For example, by default, the VPN server runs on UDP port 443, so you should configure the security group and ACL rules as follows:

Rules for VPN traffic with deliver route action

When the client is connected to the VPN server, the VPN server drops all traffic from the client by default. You have to configure the VPN route on the VPN server to allow this traffic. The action of the route may be either deliver or translate.

• When the action is deliver, after the packet is decrypted from the tunnel, the packet is forwarded directly, so the source IP of the packet is the VPN client IP, which is from the client IP pool.
• When the action is translate, after the packet is decrypted from the tunnel, the source IP of the packet is translated to the private IP of the VPN server, then the packet is sent.

Note which CIDR should be specified when you create the security group and ACL rules.

At the same time, you need to configure the security group and ACL on the VPC VSI to unblock traffic from the VPN client:

For example, if you use 172.16.0.0/20 as the client IP pool when you provision the VPN server, and you want to access the resources of subnet 10.240.128.0/24 from the VPN client, you need to create a VPN route with destination:10.240.128.0/24, and action: deliver. You should also configure security group and ACL rules as follows:

Rules for VPN traffic with translate route action

The rules for the VPN translate route are almost the same as the deliver route. The only difference is the source IP of the packet is translated to the VPN server's private IP. Therefore, you must use the VPN server's subnet instead of the VPN server's client IP pool.

If you select multiple subnets when you provision the VPN server, you must include all subnets in the security group and ACL rules.

Normally, the destination of the VPN translate route is out of the VPC. For example, suppose that you want to use a VPN server to access the IBM classic infrastructure virtual server instance. At the same time, you must configure firewall rules on the destination to unblock traffic from the VPN client.

For example, if you use the subnets 10.240.64.0/24 and 10.240.129.0/24 when provisioning the VPN server, there is a subnet 10.187.190.0/26 in the IBM classic infrastructure, and you want to access the classic virtual server instance from the VPN client. Then, you must create a VPN route with destination: 10.187.190.0/26, action: translate, and configure security group and ACL rules as follows: