VPN BIG-IP Edge client : firewall rules applied by BIG-IP Edge Client

When creating the "Customize Windows Package".

When logged on to the BIG-IP APM GUI go to:

Access > Connectivity / VPN > Connectivity > Profiles.

Select the profile for your "always connected mode".

Click Customize Package.

Select BIG-IP Edge Client

Under Exclusions List click Add.

Per the help section:

Exclusions list The Exclusions list specifies addresses that are accessible when Block mode is configured. You can specify up to ten addresses. Addresses can be IPv4 addresses, IPv4 address:port pairs, or fully qualified domain names.

If you are looking for a broader access for clients when they are disconnected from the VPN, you may want to consider using Allow-Only-In-Enterprise-LAN.

Per the help section: Allow-Only-In-Enterprise-LAN - In this mode, traffic in the local network is allowed when the VPN is not connected. The local network is determined by configuring the Location DNS List in the Connectivity Profile.

Once the is configure the package will need to be downloaded and installed on the client device.

Hope that helps.