End Point Security - D-Link DFL-1600 User Manual

208 Chapter 21. VPN Planning
A common misconception is that VPN-connections are equivalents to the
internal network from a security standpoint and that they can be connected
directly with no further precautions.
It is important to remember that although the VPN-connection itself may
be secure, the total level of security is only as high as the security of the
tunnel endpoints.
It is becoming increasingly common for users on the move to connect
directly to their company's network via VPN from their laptops. However,
the laptop itself is often not protected. In other words, an intruder can gain
access to the protected network through an unprotected laptop and
already-opened VPN connections.
In conclusion, a VPN connection should never be regarded as an integral
part of a protected network. The VPN gateways should instead be located
in a special DMZ or outside a firewall dedicated to this task. By doing this,
you can restrict which services can be accessed via VPN and modem and
ensure that these services are well protected against intruders.
In instances where the firewall features an integrated VPN gateway, it is
usually possible to dictate the types of communication permitted. The
D-Link VPN module features just such a facility.
21.1.1

End Point Security

A basic precaution to take in protecting your network against modem and
VPN connection attacks is to ensure that roaming users never communicate
directly with the Internet. Instead, they should always be routed through
the VPN or modem connection and the company's network, irrespective of
whom they wish to communicate with. This way, they enjoy more or less
the same level of protection as the rest of the network. For VPN
connections, a competent VPN client that can block all inbound Internet
traffic, aside from that which passes through the VPN connection, must be
installed on each portable or home computer.
It is also important to remember that the same restrictions placed on
in-house computers should also be placed on the portable or home
computers accessing the corporate network. Actually, higher restrictions
should be placed on the roaming clients.
D-Link Firewalls User's Guide