External (Reverse?) Captive Portal

tacabana · Nov 7, 2006, 2:33 AM

I have the current setup.

ISP
|
DMZ Subnet
|
IPSEC VPN Hardware
|
VPN Subnet
|
Mail Server

I have been asked to allow access to the corporate mail server's web interface from the Internet without requiring VPN software for each user, however I don't want to have to move the mail server from the VPN subnet. Could a Captive Portal be used to provide access to authenticated users from the Internet (SSL VPN)? If so, how? A WAN link (routable interface) can't be chosen for a captive portal.

IE.

Notes:
DMZ is routable /27 subnet using Proxy Arp.
Using pfSense 1.0.1

sullrich · Nov 7, 2006, 2:35 AM

That is not currently possible, unfortunately.

hoba · Nov 7, 2006, 2:35 AM

This is more suitable for your needs: http://sourceforge.net/projects/sslexplorer/

tacabana · Nov 7, 2006, 2:50 AM

SSL-Explorer looks to be just the ticket. Didn't know this project existed…

Thanks to all for the very quick responses.

hoba · Nov 7, 2006, 2:52 AM

sslexplorer even has a built in java vpn client. It's pretty cool. Just forward the configured port to the ssl exporer and configure your users/apps there. I tested this at our office. works great.