?
Solved

Adding a second router, keeping first for VPN only

Posted on 2009-02-18
6
Medium Priority
?
710 Views
Last Modified: 2012-06-27
I have a Sonicwall TZ-170 and use it in NAT mode for internet access and VPN to connect remote offices. Since I'm reaching the limit for maximum users on the Sonicwall, I want to redirect the internet gateway to a new router while keeping the Sonicwall for VPN access only.

What's the best way to perform this setup?

P.S. New router will be PFSense based custom box.

0
Comment
Question by:Mysterion
  • 3
  • 3
6 Comments
 
LVL 6

Expert Comment

by:ajeab
ID: 23674718
you will want to set default route for all traffic to new box.
 then put static route for address range that need to go over VPN to old box.

example: your network is 192.168.1.x.   Remote network 192.168.2.x

route 0.0.0.0 0.0.0.0 192.168.1.2(newbox)
route 192.168.2.0 255.255.255.0 192.168.1.1(oldbox)
0
 

Author Comment

by:Mysterion
ID: 23675049
The Sonicwall only receives VPN connections, it does not initiate them. Do I still need routes using this setup? The remote computers connect through VPN and then use RDP to local workstations.

Do I have to setup the Sonicwall in transparent (standard) mode or do I still use NAT ?
0
 
LVL 6

Expert Comment

by:ajeab
ID: 23675900
you do need to route.  the end point network need to route to vpn box.  otherwise, the traffic will come in from old box and attempt to go out on new box. result vpn tunnel establish but traffic is not pass between each other.
0
A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

 

Author Comment

by:Mysterion
ID: 24471070
Sorry for the delay, just didn't have time for this problem lately.
So if I understand right:

Oldbox's IP = 192.168.1.1
Newbox's IP = 192.168.1.2

On newbox I have to create a route for EACH of my remote networks using VPN
No route creation needed on oldbox
Newbox is now used as gateway for all workstations

Since newbox is now the internet exposed device, how do I redirect VPN traffic to oldbox? Do I forward specific ports?
0
 
LVL 6

Accepted Solution

by:
ajeab earned 2000 total points
ID: 24485011
you need to set route statement in newbox to tell where traffic should go next.  by default all traffic will forward to wan side of the new box. but for VPN you have to tell them to go to old box next.
ex:
in pfsense
click system --> static route
click +
interface = lan
network = 192.168.2.0 (or what ever your other endpoint is)
gateway = 192.168.1.1

you have to do this on every one of VPN connection you have.
no need to change anything at old box
0
 

Author Closing Comment

by:Mysterion
ID: 31548444
OK I get the idea, can't test now but the concept is very clear. I tought there would be a simpler solution but I'll create the routes one by one as I was trying to avoid :-) Thanks.
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
Before I go to far, let's explain HA (High Availability) and why you should consider it.  High availability is the mechanism used to provide redundancy to any service at the same site and appears as a single service to the users of that service.  As…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question