@Fae 

Thank you for your reply, it is highly appreciated.

Regarding your points:

 

1. The VPN password can be seen after we Edit the specific VPN policy, it's not directly showing on the VPN page. Is it really necessary to hide the VPN password in the VPN user list?

The fact, that you are able to show password, proves you are storing them either clear text, or reversible algorithm. This is a password, which allows passing my firewall and accessing my intranet. Frankly, with my understanding of security principles, it makes me unhappy. If may assume, you solely rely on Mongo security, but not sure it is sufficient for specific case. Anyways, I'd be glad to know I've missed something and there is a reason to have a peace of mind.

2. Sorry that I'm not sure if I understand you correctly. Do you mean that there are unknown clients attempt to connect to the VPN you setup on the TL-R605, and you want to block the unknown clients to connect the VPN? How do you find that you are receiving malicious attempts? 

There are enormous pptp access attempts reaching average ip, including mine. Omada reports on unsuccessful PPTP login attempts and source IP's too. Those usually come from address pool, rather than single on, to avoid typical blacklisting. Unfortunately I had no chance to find possibility to limit VPN to trusted IP pools only, which is a usual practice in high security environments. Hope this would become available soon.

3. For the VPN client list, I've forwarded this as a feature request to the developer team who will add it in the subsequent update.

Great to know, thank you

4. For the Omada gateway, the VPN subnet cannot be in the same network segment with the LAN IP, I'm afraid that you may need to set the VPN subnet with a different network segment.

This is not something unusual and unbelievable, Windows Server has an ability to add VPN client to the current subnet. But if you prefer not to do so, it is up to you.

 

 

And one more security concern in addition:

5. I was unable to find notifications setting, which allows event and alert triggering when NAT port forwarding feature is accessed. Which is also an important security measure. 

 

Kind regards

@Fae 

Fae wrote

Dear @Varaba 

 

And one more security concern in addition:

5. I was unable to find notifications setting, which allows event and alert triggering when NAT port forwarding feature is accessed. Which is also an important security measure. 

 

Do you wish to add notifications setting to allow event and alert triggering 1) when there is a device accessing the network through NAT port forwarding, or 2) when the settings of NAT port forwarding are viewed or changed?

 

From my understanding, it's more likely to be the former, but I'd like to confirm with you.

Sure, the first one.

Thanks a lot for prompt responses.

I will second the need to smarten up the VPN in the Omada products, it lacks in fine control in many areas. Great system but needs finishing in this whole area.