Skip to content
Avanet

Set up Sophos Firewall Clientless SSL VPN for RDP and SSH

Sophos Firewall

With Clientless SSL VPN, a Sophos Firewall provides individual internal RDP, SSH, VNC, or file server connections directly in the browser. The user does not install a VPN client and does not receive general access to an internal network. Instead, the user signs in to the VPN Portal and sees only the bookmarks published by the applicable clientless policy.

The similar name can easily lead to the wrong configuration: Clientless Users map a fixed internal IP to an identity. They don’t publish bookmarks and aren’t part of this remote access workflow.

Signing in to the VPN Portal and signing in to the target are two separate steps. Clientless SSL VPN does not support credential passthrough: The password for the VPN Portal is not automatically forwarded as the Windows or SSH login. Two logins are therefore normal unless target credentials are stored in the bookmark.

The core process is short:

  1. Define a fixed target system, port, and authorized user group.
  2. Create an RDP or SSH bookmark under Remote access VPN > Clientless SSL VPN policy > Bookmarks.
  3. Connect the user group and bookmark under Policies.
  4. Secure the VPN Portal, certificate, authentication, MFA, and Device Access.
  5. Test access externally under VPN > Clientless access connections with an authorized and an unauthorized user.

When Clientless SSL VPN fits—and when it does not

Clientless Access is particularly suitable for a small number of fixed targets, occasional access, or external technicians when no VPN client should be installed on the device in use. RDP and SSH then do not need to be published directly to the internet through DNAT. Instead, the secured VPN Portal is publicly accessible.

However, it is not a lightweight replacement for every Remote Access VPN:

  • Clientless SSL VPN is suitable for individual static RDP, SSH, VNC, or file server targets that can be operated in a browser.
  • Sophos Connect with IPsec or SSL VPN is a better fit when a managed device needs multiple networks, native applications, DNS, or different protocols. The Remote Access decision guide explains the options.
  • ZTNA is designed for persistent application-specific access with identity, device health, and central policies. The basics are covered in What is Zero Trust Network Access?.
  • RD Gateway, a jump host, or PAM should be considered when privileged administration, personal target accounts, session recording, or approval workflows are essential.

For RDP, it is also important to note that the clipboard has not been supported in clientless sessions since SFOS 19. If copy and paste or other native RDP functions are essential to the workflow, a client-based or specialized access method is the better choice.

Clientless SSL VPN does not support dynamic target IP addresses. A hostname is allowed as a target, but the firewall must resolve it reliably and it must point to the intended system. A frequently changing target should not be planned as a reliably updated dynamic DNS scenario.

Requirements and example values

Before configuration, clarify the target, identity, and portal access:

  • The target system is reachable from the firewall through routing and DNS, and the required service is running.
  • A user or, preferably, a narrowly scoped group exists on the firewall or the connected authentication server.
  • The VPN Portal has a public or internally reachable FQDN and a matching trusted certificate.
  • A suitable method is selected under VPN portal authentication methods in Authentication > Services.
  • MFA and an independent recovery method are prepared.
  • A decision has been made on whether target credentials may be stored in the bookmark.

The following RDP example uses:

  • VPN Portal: https://vpn.example.com
  • Target server: rdp-app01.intern.example
  • Target IP: 10.20.30.25
  • RDP port: 3389
  • Bookmark: RDP-Fibu-Test
  • Group: Clientless-RDP-Fibu
  • Policy: Clientless-RDP-Fibu
  • RDP security for the initial test: TLS
  • Automatic login: disabled
  • Share session: disabled

example.com is a reserved example domain and 10.20.30.25 is a private example address. Replace the FQDN, IP, group, and names with values from the local environment. Port 3389 is correct only if the Windows server actually uses the standard RDP port.

Set up an RDP bookmark

Bookmark with TLS and a personal target login

Create a new bookmark with Add under Remote access VPN > Clientless SSL VPN policy > Bookmarks:

  1. Enter RDP-Fibu-Test under Name.
  2. Select RDP as Type.
  3. Enter rdp-app01.intern.example or the fixed IP 10.20.30.25 under URL.
  4. Use service port 3389. Enter a different port only if it has deliberately been configured differently on the target system.
  5. Leave Automatic login disabled for the initial test.
  6. Enter the Windows network domain if required, for example CORP or corp.example.com.
  7. Select TLS under Protocol security.
  8. Leave Share session disabled.
  9. Select Save.

Without Automatic login, the user enters the credentials in the RDP window that opens. This allows a login with a personal Windows account if the target server’s security model permits this TLS mode.

The VPN Portal certificate and Protocol security: TLS serve different purposes. The portal certificate protects the browser connection to the firewall. The RDP setting protects the downstream connection from the firewall to the Windows system. A valid portal certificate therefore does not replace appropriate RDP security.

When the Windows server requires NLA

Many Windows systems require Network Level Authentication (NLA). In that case, select NLA in the bookmark. SFOS then enables Automatic login, and the username and password for the target system must be stored in the bookmark.

This is not merely a convenience option. All users authorized for this bookmark then work on the target system with the same stored Windows identity. Use only a dedicated, minimally privileged, and rotatable account. Domain admin accounts, personal administrator accounts, and broadly privileged service accounts do not belong in a clientless bookmark.

Do not disable NLA on the Windows server solely to make the TLS example work. If stored credentials or a shared target identity are unacceptable, Clientless RDP is not suitable for this server. A regular VPN, RD Gateway, PAM, or a controlled jump host better preserves personal accountability.

Leave Share session disabled as well. The option is intended for a deliberately planned collaboration scenario. In a shared session, Stop session ends the connection for all participants, while Suspend session pauses only the current user. Sessions should not be shared for privileged administration.

Configure the clientless policy and VPN Portal

Connect users and bookmarks in a policy

An existing bookmark alone does not make the target visible to any user. The policy connects the identity and resource:

  1. Open Remote access VPN > Clientless SSL VPN policy.
  2. Select Add under Policies.
  3. Enter Clientless-RDP-Fibu as Name.
  4. Under Policy members, select only the Clientless-RDP-Fibu group.
  5. Under Published bookmarks, select RDP-Fibu-Test.
  6. Select Apply.

A bookmark group is useful only when the same users need multiple targets. For a single RDP target, it only adds another administrative layer.

Secure the VPN Portal

Users open clientless connections through the VPN Portal. The default port is 443; the port and certificate are configured under Administration > Admin and user settings > Admin console and end-user interaction. In this example, the certificate must contain vpn.example.com as a SAN and be accepted by the browser without a warning. Import and assign certificates on Sophos Firewall explains the general certificate assignment.

Under Administration > Device access, VPN portal must be allowed for the access that is actually required. If the portal must be reachable from all WAN sources, enable WAN in the matrix. For known source networks, use the narrower option: Leave WAN disabled in the matrix and create an Accept rule under Local service ACL exception rule with Source zone: WAN, the specific Source Network / Host, the required firewall address as Destination host, and Services: VPN portal. An additional Accept exception does not narrow an already enabled general WAN matrix permission. This does not automatically permit WebAdmin, User Portal, SSH, or SSL VPN as well. Device Access and Local Service ACL explains secure planning.

⚠️ A VPN Portal reachable from the WAN is a public login surface. It should not be operated without MFA, a trusted certificate, narrow policy membership, and login monitoring. If the VPN Portal and SSL VPN share the same port and protocol, their reachable zones can affect each other; this port-sharing behavior must be checked separately.

For local Sophos OTP, first select Specific users and groups under Authentication > Multi-factor authentication. For self-registration with an authenticator app, enable Generate OTP token with next sign-in, select VPN portal under Require MFA for, and save with Apply. Enable MFA for Sophos Firewall covers the pilot and recovery path. The VPN Portal does not support challenge-based RADIUS MFA, so an existing RADIUS method must be tested specifically for this portal login. If the portal should use Microsoft Entra ID SSO and Conditional Access instead, Entra ID SSO for Sophos Connect and VPN Portal explains the complete identity chain.

Test external access

Test from a genuinely external network, for example through a mobile hotspot. A test from the LAN does not prove that DNS, the certificate, Device Access, and an upstream router work correctly from the internet.

  1. Open https://vpn.example.com in a private browser window.
  2. Check the certificate name, certificate chain, and browser status.
  3. Sign in with a member of Clientless-RDP-Fibu and complete MFA.
  4. Under VPN > Clientless access connections, verify that RDP-Fibu-Test appears.
  5. Select Connect. The session must open in a new browser window.
  6. With Automatic login disabled, enter the personal Windows credentials and verify the RDP login.
  7. Sign out cleanly from the Windows system, then leave the VPN Portal.
  8. Test with a user outside the group. The bookmark must not appear for that user.
  9. As a test, remove the test user from the policy group and verify that access disappears after a new login.

Success means more than seeing a desktop. The positive-test user sees exactly the intended bookmarks, the negative-test user sees none, MFA is enforced, the certificate is trusted, the target login works, and the session ends traceably on both the portal and target system.

SSH, VNC, and file server options

SSH bookmark with a verified host key

For SSH, select SSH as Type under Bookmarks > Add. This example uses srv-linux01.intern.example, port 22, and the user clientless-test.

The Public host key must belong to the expected server. On a Linux target, display the public host key directly at the trusted server console and document its fingerprint:

sudo cat /etc/ssh/ssh_host_ed25519_key.pub
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Run these commands on the Linux target server, not on the Sophos Firewall. If the server uses a different host key type, adjust the filename accordingly. Do not blindly accept a key from an unverified browser warning or an arbitrary network scan.

The first command outputs the public ED25519 host key that is pasted into Public host key in the bookmark. The second command only displays the fingerprint for the documented comparison; do not paste the fingerprint into the field instead of the key.

Then create the complete SSH bookmark:

  1. Under Name, enter SSH-Linux-Test, for example.
  2. Select SSH as Type.
  3. Enter srv-linux01.intern.example under URL and 22 as the port.
  4. Under Username, enter clientless-test or the intended target user.
  5. Leave Automatic login disabled if the user should enter the target password personally.
  6. Paste the public host key verified directly on the target system under Public host key.
  7. Leave Share session disabled and select Save.
  8. Add the bookmark to Published bookmarks in the clientless policy and select Apply.
  9. In the VPN Portal, select Connect under VPN > Clientless access connections, enter the target password, and verify that the expected terminal prompt appears. Then close the SSH session cleanly.

Without Automatic login, the user enters the target password when connecting; the username remains part of the bookmark. Different personal SSH usernames therefore require separate bookmarks or another access method. With Automatic login, SFOS can use a password or private key. Privileged or widely used private keys should not be stored in a shared published bookmark.

Other bookmark types

SFOS 22 also documents:

  • VNC for graphical access to appropriately configured Linux or UNIX systems.
  • FTP, FTPS, SFTP, and SMB for browser-based file server access. This does not create a normally mounted network drive. For confidential data, prefer SFTP or FTPS over unencrypted FTP.
  • Telnet as a terminal type. Because Telnet does not encrypt the transport, it should not be used for new access.

HTTP and HTTPS bookmarks are not among the currently documented clientless types for SFOS 22. Depending on the required protection, Web Application Firewall or ZTNA is the more appropriate architecture for internal web applications.

Troubleshoot common issues

  • VPN Portal is unreachable: Check the public DNS record, port, upstream NAT, Administration > Device access, and possible port-sharing behavior.
  • Portal login fails: Under Authentication > Services, check VPN Portal authentication, user status, MFA, and access_server.log.
  • Clientless access connections is missing: The user is not assigned to a clientless policy, or the policy does not publish a bookmark.
  • The bookmark is visible to the wrong user: Check Policy members, group memberships, and Published bookmarks. If several groups match, Clientless SSL VPN can combine the permissions from the corresponding policies. The positive and negative tests must verify which bookmarks a real user consequently sees.
  • The bookmark opens, but the target remains unreachable: Check DNS resolution from the firewall’s perspective, the static target address, routing, target port, service status, and host firewall.
  • VPN Portal login works, but Windows login does not: The portal and target logins are separate. Check the domain, target account, password, and TLS or NLA.
  • NLA enables Automatic login: This is the documented behavior. Do not disable NLA without planning; reassess the account and access model instead.
  • SSH reports a different host key: Stop the connection and verify the change directly on the target system or with the responsible operator. An unexpected key can indicate a reinstallation, the wrong target, or an attack.

Under Diagnostics > Tools > Troubleshooting logs, different files help with different stages:

  • vpnportal.log for the VPN Portal;
  • access_server.log for authentication and authorization;
  • clientless_access.log for clientless connections and establishing the target connection;
  • oauth_sso_vpn.log for VPN Portal logins using SSO.

Document the test time, user, bookmark, and target together. This makes it possible to distinguish portal, identity, and target problems in the logs. Sophos Firewall service logs explains the general log assignment and access through Advanced Shell.

Operation and known RDP limitations

Review clientless policies regularly like other Remote Access permissions. Remove users, bookmarks, and target accounts that are no longer required. Stored passwords or private keys need an owner, an expiry date, and a rotation process. Include Automatic login and Share session in every access review.

RDP has two current limitations that should not be treated as configuration errors:

  • The clipboard has not been supported in clientless RDP bookmarks since SFOS 19. Copy and paste between the local device and the RDP session is therefore not a reliable workflow.
  • The mouse pointer can appear as a cross or X instead of a normal arrow in the HTML5 RDP session. Sophos currently lists no workaround.

If the clipboard, native RDP functions, broader network access, or personal target accounts on an NLA-enforced server without stored credentials are essential, Clientless SSL VPN is not the right shortcut. Deliberately move access to Sophos Connect, RD Gateway, PAM, a jump host, or ZTNA instead.