Pardon my ignorance, but I've been thrust into configuring this RVL200 device to allow SSL VPN access to a remote client site, sight unseen.  I have the basics of the VPN connection set up in the config, but am now moving on to the firewall rules.  We want to block all internal devices from having any access to the Internet, but I don't want to cripple the remote clients that will be connectiong by blocking their return traffic over the SSL VPN.  This leads to my questions:

1) Will a blanket DENY rule for all OUTBOUND traffic prevent the primary function of the VPN (to allow remote administration of machines on the LAN)?

2) If the answer to #1 is "Yes", what ports/services would I need to open up from the LAN side?

3) Building off #2, how would I configure the allowed outbound rules to apply only to the VPN clients, rather than all LAN hosts?

4) Since the default INBOUND rule is to DENY ALL, do I need to create a rule to allow the VPN tunnel, or is that assumed in the router configuration?

Here are some other details:

• The LAN behind the RVL200 is an otherwise isolated LAN in a manufacturing environment
• All hosts on that network have static IP addresses on a single subnet. 
• The RVL200 has been configured with a static, public IP address on the WAN/INTERNET side.
• DHCP has been disabled on the RVL200 
• Authentication to the device will use a local database.
• No DNS servers exist on the LAN
• The upstream device from the RVL200 is a DSL modem using PPPoE, and the device has been configured for that setting.
• Numerous local user database accounts have been created to facilitate SSL VPN access.

I've worked with other aspects of IT for a long time, but limited experience with VPNs and the associated firewall rules, and none with this family of device.  Any assistance will be greatly appreciated.

Answer:

1. Yes, it will deny the rule.

2. You can forward ports 47, 50, 500, 1723 for VPN

3. You can forward the port for the each computer that you will allow it. This is done via IP address of the said computer.

4. If you set it that way, there's no need to create another rule. The rule will be applied  already.

Hope this helps!