SonicWALL - Static Route a VLAN


I am struggeling with routing specific WAN/LAN IP's on a specific VLAN Interface, through a VPN connection instead of routing through the default gateway.

Lets say the customers VLAN IP is and the default customer gw is They have a VPN box on this network that has a site to site connection to another location, with the IP:

I need to route some specific IP's through this VPN box,, and not the default gateway,

The rules is as follows:

Source: VLAN56 Subnet (
Destination: Address Object Group (, etc)
Service: Any
Gateway: VPN Box -
Interface: VLAN56 Interface (the customer VLAN interface)

Because I have not been able to solve this, I've used a temp quick fix on windows level. By using a bat file, like this:

route ADD MASK

This works for now, but I'd rather manage this route with our FW.

Note: I have only tested this SonicWALL route on a virtual machine, and no physical machines, if that matters.

Edit: I should add that this is my first time trying to add a Static route in SonicWALL. I have used the information I could find online on how to do this, and there might be some basic config mistakes/errors. :-)
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Manuel FloresCommented:
If I understand correctly, the PC that must to connect to network 192.168.2.x is on the same router network 192.168.1.x

In such a case, a static route configured in each PC of 192.168.1.x network is the solution.  You made it using route ADD MASK and it worked as far as I understand.

Under my point of view this correct.  You could force/apply some domain (if it exists) level script to setup that route to all the machines.

Please, let me know.

Manuel FloresCommented:
You can also try changing the config...  aprox to:

Current config
                    192.168.1.x net  
router gw ----------------------------------------
                             |             |      |      |
                 VPN router      PC    PC   PC

New config
                   192.168.3.x net                                          192.168.1.x net
router gw-------------------------------------- VPN router --------------------------------
                                                                                                    |      |       |      
                                                                                                  PC    PC     PC

And configure VPN router with default gw to the router gw and a VPN route to the correct vpn gw

This way you don't need to change anything on the PC

itavdelingenasAuthor Commented:
Hi Manuel,

Thanks for answering this fast. Yes, the BAT file is already a logon script, so it applies to every machine in the domain at this moment.

We have a primary management network that is, and the SonicWALL has IP of 1. And we have several VLANs for customers, that has its own VLAN interface and network. The is the customer network.

I was really hoping this was possible with a Static route or maybe by adding a NAT rule?

I have added a simple paint pic on how the setups is, roughly.
Get Blueprints for Increased Customer Retention

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

Manuel FloresCommented:
No, if the PC's are in the same network of the VPN router, a static route into the PC is the solution.  You must think that, indeed, you have two gateways in the client network, you must indicate to the PC what should be routed for what gateway.
itavdelingenasAuthor Commented:
I see. If we take the VPN box out of the actual network, and set it some kind of DMZ zone, a different network than the clients/servers, will that allow us to route it properly?

This might be what you already explained, Im just slow.. :-)
Manuel FloresCommented:
That is possible, and apart from having configured the VLAN correctly, the topology is aprox.:

New config
                   192.168.3.x net                                          192.168.1.x net
router gw-------------------------------------- VPN router --------------------------------
                                                                                                    |      |       |      
                                                                                                  PC    PC     PC

So the VPN box is the only gateway for 192.168.1.x, and a couple of static routes configured on it; the default to external world, and the one to 192.168.2.x network will be enough and should work.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
itavdelingenasAuthor Commented:
Thanks for all your help Manuel. I will make the changes you suggested. :-)
J SpoorTME / Network Security EvangelistCommented:
Use Route Based VPN rather than policy based VPN

View more example configurations and the SonicWALL webui and features on or
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.