Route IP address through Sonicwall VPN

Posted on 2014-04-11
Last Modified: 2014-04-22
I have two offices with Sonicwall TZ205s and a VPN tunnel between them. At one office, the ISP is blocking us from authenticating to a specific IP address. The other office can get to it fine. Is there a way to route all calls to a specific WAN address through the VPN and use the internet connection on the other side?
Thank in advance.
Question by:Dalamar9
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 5
LVL 27

Accepted Solution

skullnobrains earned 500 total points
ID: 39995993
yes : use policy based routing.

condition is the destination address you cannot reach
target is the lan address of the firewall on the other side of the tunnel
i don't remember if you need to specify the interface as well but it should be clear once you are creating the rule
LVL 79

Expert Comment

ID: 39996528
You can within the SITE TO SITE VPN TUNNEL specification include the IP in question
SITE1 allowed access LAN1

your VPN policy will be to include the IP_inquestion in the SITE2 VPN setting

remote LAN: LAN1 and IP_inquestion

If your VPN setup includes dynamic routing protocol updates, all you would need to do in this case, is advertise the IP/32 to the SITE2 VPN.

The remaining question is whether your Sonicwall VPN will allow the request that came in via the VPN to leave the outside interface.

Author Comment

ID: 39999401
skullnobrains, I tried the routing method, but it doesn't give me access. I've setup the route from the Site 2(cannot authenticate) LAN to the IP with the gateway as the router on the other side (Site 1). Do i need to add anything to the router on Site 1?

arnold, I tried to setup the VPN as suggested, but I'm not sure I've got the parameters correct on both sides. Site 1 can access the IP address, Site 2 cannot. Since Site 2 can see the IP, but not authenticate to it, I assume I have to add a firewall rule denying access from Site 2 LAN to WAN for the IP. I also added a rule allowing Site 2 LAN to VPN for the IP. I added the IP to the remote network on the Site 2 side of the VPN. I also added a firewall rule allowing VPN to WAN for the IP on the Site 1 side. With these settings, I can't ping the IP from Site 2. Am I missing something?
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 27

Expert Comment

ID: 39999438
what you setup is a little unclear to me.

you need the gateway to be the lan address of the other side of the vpn

you can list existing routes on your firewall. the existing routes that are used to reach the network at site1 should serve as a model if your VPN works

assuming that you can normally ping machines from one side of the vpn to the other, nothing should be needed to be set on site 1 in terms of routes. but you may need a firewall rule allowing the corresponding traffic, and you need to apply nat if the site is external to your LAN. it is likely that your firewall is setup to only allow internet access to hosts on site1

for debugging routes, ping is pretty useful : ping the router from a regular host to start with and move on

Author Comment

ID: 39999748
Actual numbers:
Side that can't authenticate: with router at
VPN established to site that can authenticate through
IP address with the issue is

On 10.1.1 side, route added:
Source: LAN Primary Subnet (
Interface: WAN

On the 10.1.2 side Access rule added:
Action: Allow
From Zone: VPN
To Zone: WAN
Service: Any
Source: 10.1.1.XXX

Still can't ping from 10.1.1 side.
LVL 27

Expert Comment

ID: 40000082
the server at does respond to pings, but i was not really expecting end-to-end pinging to work straightaway

the route looks good, and unless you forgot nat, the rule as well.

can you confirm that you can ping from your source machine ? (this should be the case if the VPN works properly)

can you confirm that on your side, you have a rule that allows that traffic. it seems possible that you only allow traffic through the VPN when it is targeted to the 10.1.2.x network

if yes to both of the above, can you run a packet sniffer on ? do you see packets reaching through the VPN when you try to connect to the web site ? do you see those same packets leaving through the wan interface ? what about return packets ?

Author Comment

ID: 40004762
I have only default/automatically generated NAT entries. Sould there be something else?
I can ping from the source.
i have a Side2Subnet-VPN to Any-WAN rule on the destination side so it should allow traffic coming through the VPN to access outside IPs.

I'm getting no packets on the side. I think they are being stopped before they even get to the VPN.
LVL 27

Expert Comment

ID: 40006071
if you can ping but http packets don't reach, you probably don't have a rule that allows routing http traffic over the VPN on side1. you can confirm this by sniffing inbound and vpn interface on side1.

Assisted Solution

Dalamar9 earned 0 total points
ID: 40007113
Well after all of that, i finally did some testing onsite at the location with the problem. Turns out the sonicwall itself was blocking the IP address. No idea how or why. No changes were made when it went down and we're not subscribed to any blacklisting service. I'm now using an older sonicwall on an extra WAN IP address and sending internet traffic there. I'm thinking that the sonicwall is not allowing that IP address though its own VPN as well as through the WAN.
Any way, thanks for all of your help.
LVL 27

Expert Comment

ID: 40007886
if you found a solution to the question you actually posted, you should post it and accept it as a solution. of all people i'm interested

Author Closing Comment

ID: 40014359
Found another work around for the issue which seems tied to the specific hardware. I believe the answers provided by skullnobrains would have solved the problem.

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It happens many times that access list (ACL) have to be applied to outgoing router interface in order to limit some traffic.This article is about how to test ACL from the router which is not very intuitive for everyone. Below scenario shows simple s…
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month6 days, 12 hours left to enroll

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question