Solved

Route IP address through Sonicwall VPN

Posted on 2014-04-11
11
506 Views
Last Modified: 2014-04-22
I have two offices with Sonicwall TZ205s and a VPN tunnel between them. At one office, the ISP is blocking us from authenticating to a specific IP address. The other office can get to it fine. Is there a way to route all calls to a specific WAN address through the VPN and use the internet connection on the other side?
Thank in advance.
0
Comment
Question by:Dalamar9
  • 5
  • 5
11 Comments
 
LVL 26

Accepted Solution

by:
skullnobrains earned 500 total points
ID: 39995993
yes : use policy based routing.

condition is the destination address you cannot reach
target is the lan address of the firewall on the other side of the tunnel
i don't remember if you need to specify the interface as well but it should be clear once you are creating the rule
0
 
LVL 76

Expert Comment

by:arnold
ID: 39996528
You can within the SITE TO SITE VPN TUNNEL specification include the IP in question
i.e.
SITE1 allowed access LAN1
SITE2 DENIED ACCESS LAN2

your VPN policy will be to include the IP_inquestion in the SITE2 VPN setting

site2
remote LAN: LAN1 and IP_inquestion

If your VPN setup includes dynamic routing protocol updates, all you would need to do in this case, is advertise the IP/32 to the SITE2 VPN.

The remaining question is whether your Sonicwall VPN will allow the request that came in via the VPN to leave the outside interface.
0
 

Author Comment

by:Dalamar9
ID: 39999401
skullnobrains, I tried the routing method, but it doesn't give me access. I've setup the route from the Site 2(cannot authenticate) LAN to the IP with the gateway as the router on the other side (Site 1). Do i need to add anything to the router on Site 1?
Thanks.

arnold, I tried to setup the VPN as suggested, but I'm not sure I've got the parameters correct on both sides. Site 1 can access the IP address, Site 2 cannot. Since Site 2 can see the IP, but not authenticate to it, I assume I have to add a firewall rule denying access from Site 2 LAN to WAN for the IP. I also added a rule allowing Site 2 LAN to VPN for the IP. I added the IP to the remote network on the Site 2 side of the VPN. I also added a firewall rule allowing VPN to WAN for the IP on the Site 1 side. With these settings, I can't ping the IP from Site 2. Am I missing something?
Thanks.
0
 
LVL 26

Expert Comment

by:skullnobrains
ID: 39999438
what you setup is a little unclear to me.

you need the gateway to be the lan address of the other side of the vpn

you can list existing routes on your firewall. the existing routes that are used to reach the network at site1 should serve as a model if your VPN works

assuming that you can normally ping machines from one side of the vpn to the other, nothing should be needed to be set on site 1 in terms of routes. but you may need a firewall rule allowing the corresponding traffic, and you need to apply nat if the site is external to your LAN. it is likely that your firewall is setup to only allow internet access to hosts on site1

for debugging routes, ping is pretty useful : ping the router from a regular host to start with and move on
0
 

Author Comment

by:Dalamar9
ID: 39999748
Actual numbers:
Side that can't authenticate: 10.1.1.xxx with router at 10.1.1.250.
VPN established to site that can authenticate 10.1.2.xxx through 10.1.2.250
IP address with the issue is 216.194.164.150

On 10.1.1 side, route added:
Source: LAN Primary Subnet (10.1.1.0)
Destination: 216.194.164.150
Gateway: 10.1.2.250
Interface: WAN

On the 10.1.2 side Access rule added:
Action: Allow
From Zone: VPN
To Zone: WAN
Service: Any
Source: 10.1.1.XXX
Destination: 216.194.164.150

Still can't ping from 10.1.1 side.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 26

Expert Comment

by:skullnobrains
ID: 40000082
the server at 216.194.164.150 does respond to pings, but i was not really expecting end-to-end pinging to work straightaway

the route looks good, and unless you forgot nat, the rule as well.

can you confirm that you can ping 10.1.2.250 from your source machine ? (this should be the case if the VPN works properly)

can you confirm that on your side, you have a rule that allows that traffic. it seems possible that you only allow traffic through the VPN when it is targeted to the 10.1.2.x network

if yes to both of the above, can you run a packet sniffer on 10.1.2.250 ? do you see packets reaching through the VPN when you try to connect to the web site ? do you see those same packets leaving through the wan interface ? what about return packets ?
0
 

Author Comment

by:Dalamar9
ID: 40004762
I have only default/automatically generated NAT entries. Sould there be something else?
I can ping 10.1.2.250 from the source.
i have a Side2Subnet-VPN to Any-WAN rule on the destination side so it should allow traffic coming through the VPN to access outside IPs.

I'm getting no packets on the 10.1.2.250 side. I think they are being stopped before they even get to the VPN.
0
 
LVL 26

Expert Comment

by:skullnobrains
ID: 40006071
if you can ping but http packets don't reach, you probably don't have a rule that allows routing http traffic over the VPN on side1. you can confirm this by sniffing inbound and vpn interface on side1.
0
 

Assisted Solution

by:Dalamar9
Dalamar9 earned 0 total points
ID: 40007113
Well after all of that, i finally did some testing onsite at the location with the problem. Turns out the sonicwall itself was blocking the IP address. No idea how or why. No changes were made when it went down and we're not subscribed to any blacklisting service. I'm now using an older sonicwall on an extra WAN IP address and sending internet traffic there. I'm thinking that the sonicwall is not allowing that IP address though its own VPN as well as through the WAN.
Any way, thanks for all of your help.
0
 
LVL 26

Expert Comment

by:skullnobrains
ID: 40007886
if you found a solution to the question you actually posted, you should post it and accept it as a solution. of all people i'm interested
0
 

Author Closing Comment

by:Dalamar9
ID: 40014359
Found another work around for the issue which seems tied to the specific hardware. I believe the answers provided by skullnobrains would have solved the problem.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now