Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

SonicWall SSL-VPN, no Internet connectivity for clients

Posted on 2013-11-16
10
Medium Priority
?
9,080 Views
Last Modified: 2014-05-20
Hello,
    We have a SonicWall NSA220 and we are trying to route all internet traffic from laptops and iOS devices through the SSL-VPN. However, with tunnel all mode enabled, the internet on the client does not work. I originally had it configured with tunnel all mode disabled, but then the WAN IP shown on the client was not the WAN IP of the office network. How can I route all internet traffic through the SSL-VPN?

Thank you!
0
Comment
Question by:indigo6
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 12

Expert Comment

by:Infamus
ID: 39653833
Try this.

http://www.sonicwall.com/downloads/advanced_vpn.pdf

ctrl+f and search for "split tunnel".
0
 
LVL 26

Expert Comment

by:Blue Street Tech
ID: 39654250
Hi indigo6,

SSL-VPN > WAN Traffic.
To pass traffic from SSL-VPN to WAN you should manually add an Access Rule SSL-VPN > WAN Allow.

Tunnel All mode.
Tunnel All mode routes all traffic to and from the remote user over the SSL-VPN NetExtender tunnel —including traffic destined for the remote user’s local network. This is accomplished by adding the following routes to the remote client’s route table:

IP Address    Subnet mask
0.0.0.0            0.0.0.0
0.0.0.0            128.0.0.0
128.0.0.0        128.0.0.0

NetExtender also adds routes for the local networks of all connected Network Connections. These routes are configured with higher metrics than any existing routes to force traffic destined for the local network over the SSL-VPN tunnel instead. For example, if a remote user has the IP address 10.0.67.64 on the 10.0.x.x network, the route 10.0.0.0/255.255.0.0 is added to route traffic through the SSL VPN tunnel.

Tunnel All mode is configured on the SSL VPN > Client Routes page.

May I ask what the overall goal is here?
0
 

Author Comment

by:indigo6
ID: 39657718
Hi, thanks for your input. What I am trying to accomplish is more security for remote employees. When they are on the go, I want all their network traffic to pass through the SSLVPN. I have an access rule in the SSLVPN > WAN zone already (screenshot attached), but I still can't browse the internet from a remote client. The network just hangs.

Thanks!
0
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

 
LVL 26

Expert Comment

by:Blue Street Tech
ID: 39658706
There is no attachment.

Try disabling Windows firewall and retest.
0
 

Author Comment

by:indigo6
ID: 39673858
No go. :( Also, the iOS app doesn't seem to allow network access with tunnel all mode enabled.
0
 
LVL 26

Expert Comment

by:Blue Street Tech
ID: 39674674
Hmm, I haven't come across that. So are you looking into the app under routes and it's not showing that? If not, how did you determine that?
0
 

Author Comment

by:indigo6
ID: 39719667
I've attached a screenshot. Thanks!
photo.PNG
0
 
LVL 26

Accepted Solution

by:
Blue Street Tech earned 2000 total points
ID: 39719806
Ah I see.

To allow your end users access to internet over the UTM-SSLVPN, you will need to allow “WAN RemoteAccess Networks” (a network address object whose value 0.0.0.0 acts like a default route), and the Tunnel All option must be selected on the Client Routes page.  The method below is appropriate when the administrator wants all of their NetExtender users to have their internet access provided through the SSL-VPN otherwise disable Tunnel All mode.  Be sure that you are not overwhelming the internet bandwidth at the location where the firewall is installed, as this traffic will be added to the other loads from inside the network.
Step 1: On the SonicWALL, go to SSL-VPN > Client Routes screen, enable the Tunnel All option in the drop down menu.

Step 2: On the Users > Local Groups screen, configure SSLVPN Services group and under tab “VPN Access,” add the object WAN RemoteAccess Networks.

Step 3: No custom rules are needed on the Firewall > Access Rules screen for this to work.  You can see auto-added rules in the section SSLVPN to WAN.
Make sense?
0
 

Author Closing Comment

by:indigo6
ID: 39762967
Sorry for not responding in a timely manner. This got put on the backburner for a while. However, it worked! Thanks! It's obscenely slow, but that's fine for now. Thanks!
0
 
LVL 26

Expert Comment

by:Blue Street Tech
ID: 39762983
Great glad I could help and thanks for the points!

If its exceptionally slow it isn't because of the setup...the setup is straightforward in fact all we are doing is setting routing here. To correct transmission issues take a look here and change your MTU value: http://www.experts-exchange.com/A_12615.html

Cheers!
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OpenVPN is a great open source VPN server that is capable of providing quick and easy VPN access to your network on the cheap.  By default the software is configured to allow open access to your network.  But what if you want to restrict users to on…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question