Howdy.
I have ca 10 countrywide users connecting to office LAN using L2TP(IPsec) windows client (mainly for windows remote desktop and remoteapp usage). To avoid traffic on office WAN VPN clients use their own internet source while being connected to VPN - no internet packets going through the VPN host mikrotik. Thing is so far both VPN and LAN DHCP pools use same subnet (just 2 separate pools). For now all remote users can access/browse internal network (password protected obviously but thats not the superb solution).
I was thinking if I could add some rules forbidding remote users accessing most of LAN network. Preferably I’d like to use some kind of “LAN-to-VPN IP allow list” and deny rest of the LAN network.
I’m thinking of allowing users to access RDP server and lets say… storage device or network printer, nothing else…
Apreciated for any suggestions…