Flow Rules to restrict traffic to Remote Desktop only

Tips and Guides
1

I thought I would share the Flow Rules I have set up to restrict traffic on the VPN to Remote Desktop only. I have further restricted the RDP connections to those between computers with the same Tag. This allows users who have a computer at home to Remote Desktop to their work computer. It stops all other traffic and stops users connecting to computers other than their own.

Once the rule has been saved, A Tags Matrix will show up towards the bottom of the screen. To allow a computer to RD to another you must set the tag for both nodes to the same user.

#
# This rule set allows IPv4 traffic only
# and restricts traffic to Remote Desktop between matching user tags
#

# Create a tag for which user someone is
tag users
  id 1000                 # arbitrary, but must be unique
  enum 100 Andrew         # has no meaning to filter, but used in UI to offer a selection
  enum 200 John
  enum 300 Betty
;

#
# Allow only IPv4 and ARP Ethernet frames.
#
drop
	not ethertype ipv4
	and not ethertype arp
;

#
# Uncomment to drop non-ZeroTier issued and managed IP addresses.
#
# This prevents IP spoofing but also blocks manual IP management at the OS level and
# bridging unless special rules to exempt certain hosts or traffic are added before
# this rule.
#
drop
	not chr ipauth
;

# Nothing will work if ARP packets aren't allowed through
accept ethertype arp;

# Anyone can ping anyone on the VPN. This is mainly for testing purposes
accept ipprotocol icmpv4; # accept pings

# Only allow connection if sending and receiving user tags are the same
# This restricts users to only RD on their own devices
drop not tdiff users 0;  # difference between users tags is not 0, meaning they don't match

# Only accept RDP connections
# This stops other connections such as file sharing
drop not ipprotocol tcp; 
accept dport 3389; # Destination is RDP
drop chr tcp_syn and not chr tcp_ack; # No new TCP connections (except RDP)
accept; # Accept what's left, returning RDP traffic

# Reject all other packets
drop
;
3 Likes
2

I also wanted to ask if you have any experience using SSO with this?

3

This is exactly what I was looking for! Indirect replacement for a Remote Desktop Gateway Server. That said I could use one addition. In addition to some users needing to connect back to their workstations, I also have a single 'terminal server. where I would like “all users” to be able to connect to, preferably without additional 1 to 1 config. Thoughts?

4

You can solve that by matching either on the IP of that terminal, or the ZT Address if it is a ZT Node. You’d place one of these before “drop not tdiff users 0;”:

accept ipsrc <IP of terminal server> or ipdest <IP of terminal server>;
accept ztsrc <ZT Node ID of terminal server> or ztdest <ZT Node ID of terminal server>;

You can further scope it by port and protocol if you want.

5

that could work.

you might add one more tag:

tag terminal
  id 2
  enum 0 No
  enum 1 Yes
  default No;

accept not tor terminal 0;

(untested)