0

I have two networks:

Network A Private 10.0.0.0/24
Network B Private 10.0.10.0/24

Both running Sonicwall ~200 appliances, connected by a VPN tunnel.

I am able to reach specific internal address on either end of the tunnel from either location, works like a charm.

What I would like to do is route all web traffic to a specific domain (whatismyip.com, for example) such that:

When someone on network A attempts to access the website whatismyip.com the request is routed over the VPN to Network B using Network B's public IP address.

When someone on network B attempts to access the site, it should come from Network B's public IP as normal.

I've tried accomplishing this using Sonicwall Route rules, but it's not working as I expected. I'm at a loss at where to begin, really.

What is the outline of rule (Firewall / Nat / VPN / Route) configuration necessary to accomplish this?

3 Answers 3

0

This doesn't seem complicated...

Wouldn't a route for 72.233.89.196/29 on network A's router that uses the network B router as its next hop do the trick?

In this case your router is probably your firewall == vpn device == gateway.

What happens when you try this?

0

You might try a policy route pushing any traffic going to the IP of whatsmyip.com to the LAN address of sonicwall B. This would push it over the VPN and sonicwall B would use its routing table to get it out to the internet. You might also want to create a firewall rule on Sonicwall B to permit traffic from LAN A if not already set to permit all.

0

What you are trying to do is to set a routing policy based on destination hostnames rather than on destination IP's.

It is not hard at all to route all traffic from network A into network B. Set routing policy on every machine of network A except for the one as vpn node to use the vpn node as the default router, and the vpn node of network A use the vpn peer in network B as default router. Set the final outgoing machine of network B with ip_forward on and masquerade on (firewalld is the simplest to configure this feature) Thus every machine in network A will seek the vpn routing whenever the destination is beyond network A.

Once you succeed in this. You want a destination hostname based routing split, that you want some sites would still use the original public IP of network A, but the other not.

Unfortunately, the default routing rules are based on destination IP's rather than on their hostnames. First you can set split routing given that you know at least one of its IP's. Try to roll back to the default routing first, and then add this special IP to use the vpn node. Note the netmask is 32 bit now, or 255.255.255.255. To get the IP of the website, a simple ping would reveal its IP, like whatismyip.com @ 104.21.89.158 . It might have many IP's and may even change them.

It looks like one step close. Now you need to hijack the hostname resolution (DNS) to your local machine. On Linux you need to put the IP Hostname link information down to /etc/hosts or /etc/hostname. That could possibly resolve the issue.

If that still don't work, you can consider using squid as reverse proxy on the vpn node of network A. It does the transparent proxy, which means hijacking any outgoing visits.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .