LAN Access Management enables you to give limited VPN access to users. This is especially useful when your machine is equipped with devices from different suppliers. For commissioning and maintenance purposes, these suppliers may require VPN access to their devices, but not to other devices.

Note that all Web Access services (like VNC EasyControl) add a port forwarding in the edge gateway. This makes them accessible to all users with VPN access, even if it's limited VPN access. Keep this in mind when configuring your edge gateway.

Configure limited VPN access

The VPN connect service already exists when you first register your edge gateway and cannot be removed. Access is determined by the access categories that you assign to Full access and the Limited access rules that you add. Users with access to one of these access categories will then gain full VPN access or will only be able to access the specified IP address and no other devices in the machine network. More information about access categories can be found here: User management.

1. If you haven't already, create a new access category for limited VPN access at Admin > Access categories.
2. Go to Fleet Manager > Devices and click on your device name.
3. In the left menu, go to Services.
4. Click on the VPN connect service.
5. Under Limited access, add limited access.
   • Access can be granted to an individual device (IP address) or a group of devices (IP range in CIDR notation).
     • CIDR notation example: Network 192.168.140.0 with subnet mask 255.255.255.0 in CIDR notation is 192.168.140.0/24. Online subnet calculators can help you determine the correct subnet mask for your group of devices.
   • The Access category determines which users can access the specific device and which users don't. More information: User management explained. Users with the permission "Manage devices" will be able to see and use all services (full VPN access, VNC EasyControl, HTTP EasyControl, etc.) and pages, regardless of their access categories.
     

Update your user management so users no longer have full VPN access, but instead can only access the devices you specified.

6. At Admin > Roles, edit the necessary roles to:
   • revoke access to the access category that grants full VPN access.
   • give access to this new access category that grants limited VPN access.
7. The above update changes the permissions of every user with these roles. If this is undesired, you may choose to create a separate role instead, at Admin > Roles, and assign it to the user at Portal > Users.