SonicWall SSL VPN - Hosted Server

Hi FrontDist,

The SSL VPN > Client Routes page allows the administrator to control the network access allowed for SSL VPN users. The NetExtender client routes are passed to all NetExtender clients and are used to govern which private networks and resources remote user can access via the SSL VPN connection.

NOTE: All clients can see these routes. Also, here you may enable/disable “Tunnel All Mode” (this is the equivalent of “This gateway only” option while configuring GroupVPN).

The Network access is actually here, Users > Local users, VPN Access Tab:

On the VPN Access Tab allows users to access networks using a VPN tunnel, select one or more networks from the Networks list and click the arrow button -> to move them to the Access List. To remove the user’s access to a network, select the network from the Access List, and click the left arrow button <-.

Make sure your setup matches this KB: https://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=6461

Configure SSLVPN Client Routes
The SSL VPN > Client Routes page allows the administrator to control the network access allowed for SSL VPN users. The NetExtender client routes are passed to all NetExtender clients and are used to govern which private networks and resources remote user can access via the SSL VPN connection.
NOTE:  you don't have to add any client routes for the network on which the SSLVPN Client addresses are configured.  That is done automatically for you.

Adding Client Routes
The Add Client Routes pulldown menu is used to configure access to network resources for SSL VPN users. Select the address object to which you want to allow SSL VPN access. Select Create new address object to create a new address object. Creating client routes causes access rules to automatically be created to allow this access. So here select the LAN or whichever Zone the Servers are located in. Alternatively, you can manually configure access rules for the SSL VPN zone on the Firewall > Access Rules page.

Let me know how it goes!

Hi,

Thank you for your input. When I attempted to do that, what I was trying to do was add the WAN primary subnet to the accessible client routes, and don't seem to be able to do so. That is where all of the servers are hosted as well as the IP used to access the SSL VPN service on the Sonic.

We only have one router acting as the VPN end point as well as main firewall for our network and I'm trying to make this work the way I think it should, I just can't seem to get there...

Oh an by the way it has worked on my Mac all along, but all other computers on which I am trying to make this work are Windows 7 OS.

Adding the WAN client route would create a loop. The idea of a VPN (SSL or otherwise) is to get you into the Firewalled Subnets.

On the Windows 7 boxes disable firewall and AV and retest. Users & some Admins typically don't firewall their Macs probably because they suck to modify. SO the Mac may not have firewall enabled which is why its connecting OK.

Incidentally, I don't understand your topology. Your servers should be behind your main firewall either in the LAN or DMZ, like this:
ISP
|
Firewall
|
LAN or DMZ

Is this how you have it setup? If not please explain or draw as I did. Thanks!

With "tunnel all" enabled I was able to (from a VPN connection), browse out of the LAN (which I VPN'd into) to other websites on the internet, etc. So from that perspective I was able to get it to work. However, I don't think it should be blocking connections back through the same firewall, I believe it should be able to resolve a dns request and then short circuit at the firewall back to the appropriate location.

Here is the topology:

ISP
|
Sonicwall (assigned /29 public IP subnet)
|
LAN
|
192.168.10.0/24

Note: All of the internal computers, the servers and the VPN DHCP addresses are assigned addresses from the same internal subnet.

Note: No servers are on a DMZ, all are port forwarded based on a specific external IP address to their internal address.

What I was trying to do was allow Outlook on the users remote travel laptops to stay connected to our mail server regardless of being attached to the VPN or not. With the way it is working (or not as I see it) at the moment, I can either set up the server to be the public server (mail.domain.com) and it works when the vpn is disconnected, or set it up as the internal server address (192.168.10.xxx) and they can only get mail when they are connected to the VPN.

I don't think it is unreasonable to think I should be able to leave outlook set with the public domain name and have it work no matter what the connection status of the VPN is.

I hope that helps clarify my intentions a bit? Any thoughts?

Thanks for the update and clarification.

If the goal is to allow your users to VPN and to gain access to their mail anywhere they are located (inside or outside the network), then the recommended way to do this is to setup the SSL-VPN exactly as specified here (no deviation): https://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=6461 and setup the Exchange Server behind the SonicWALL in the LAN by using the Public Server Wizard within the SonicWALL or manually as set forth here: https://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=4535 and finally by enabling Outlook Anywhere on the Exchange Server.

This way all users regardless of where they are in the world will be able receive their email via Outlook client, OWA and/or mobile phones/tablets, independently, without having to go through the SSL-VPN. They would then use the SSL-VPN for other resource access like RDP, remote printing, Shares and documents, etc.

What version is your Exchange Server?

Does that make sense?

diverseit,

Thank you for all of your help and input, it just does not appear that what I want is possible. I was originally thinking it would be a simple fix like we had to do in the beginning for our servers.

When I set up our servers on the SonicWall just after we had purchased and installed it, we were unable to browse our own public website from inside the network. It took a bit of digging but somewhere under the firewall in the NAT tables, I had to create rules from the "Firewalled Subnets" pointing back at our own public IP's with the correct ports forwarded. It is kind of a short-circuit/loopback otherwise any services accessible by public IP from outside our network were unavailable inside. This was something new for me but it is exactly what you have in the second link from your last post.

Since the SSL-VPN IP's handed out are within the "firewalled subnets" range of addresses already established, I figured it should work but it just doesn't seem to. All users in our network access the mail server and our company website through the public addresses and the VPN IP's are part of the exact same range, so I just can't imagine why it doesn't work.

Example: If I VPN into the network, it doesn't work, but if I connect inside the network and hard-code the exact same IP address as the VPN would assign, everything works.

Also, we are not using exchange but rather MailEnable.

Thanks again for your input!

Hey, thanks again... and yes I meant subnet not range. I was just going over the previous post of mine and noticed that I had done that. I believe the sonic is smart enough that it won't let someone specify overlapping ranges anyways.

Once again, thanks for all of your help and input. We have a support contract with Dell/SonicWall and am still waiting to hear from them re: this issue and a workaround, but turned to EE as I have discovered there are a lot of people on here that are working with this equipment day to day and have often run into the same problems themselves.

Thanks again!

It took a call to Dell SonicWall support to solve this problem, but after a long session they were able to.

To allow this, there has to be a specific exception put in the firewall for SSLVPN-LAN, an entry was required for each internally hosted server to let the traffic pass.