Risk as illustrated above
1. A hacker on the Internet scans public IP addresses for open services and
vulnerabilities.
2. The hacker hijacks the client which has a public IP address.
3. The hacker can execute any attack posing as the hijacked computer and
can access the resources of the corporate LAN through the hijacked
computer’s PPTP connection.
Recommendations
• Create strict, separate aXsGUARD Gatekeeper Firewall Policies for PPTP
VPN access on a user / group basis in agreement with your company
policies, as explained above. The aXsGUARD Gatekeeper PPTP Firewall
configuration is explained in
Section 3.6, “PPTP Firewall Settings”
.
• Use a strong hardware or software Firewall on the client side. Ensure that
outgoing
traffic to TCP port 1723 and the GRE protocol are allowed,
otherwise the client will not be able to connect to the PPTP server (see
Section 4.2, “Client-Side Firewall”
).
Figure 2.7. Consequences of Compromised Client
© VASCO Data Security 2011
16
