We have several LAN devices connected via a physical wired network to a SonicWALL TZ210 on subnet 192.168.2.0/24. Several of those devices are assigned DHCP addresses in the range 192.168.2.100 to 192.168.2.199 and some of them have static addresses below 192.168.2.100 or above 192.168.2.240.
On the SonicWALL, I have enabled VPN and configured the L2TP server to use 192.168.2.201 to 192.168.2.220 as the local L2TP pool.
I can establish a VPN connection into the SonicWALL and as expected I get an IP address in the L2TP pool range. From the VPN device (an iPhone, but I don't think that's revelvant) I can ping other devices on the LAN, but not Windows devices - pinging MacOSX, Ubuntu, SonicWALL all work fine (both static and DHCP addresses), but not Windows. The Windows machines can ping any device except the VPN connected one. All other combinations of devices can ping each other successfully - the only failure is Windows<-->VPN.
From a little research, it seems the problem is related to routing on Windows. The route entry for the LAN shows this:
Network Destination Netmask Gateway Interface 192.168.2.0 255.255.255.0 On-link 192.168.2.173
(This is for a Win7 PC; Win XP is similar, but Gateway is listed as the local IP address, the same as Interface.)
This "On-link" indicates that all traffic destined for the LAN is being sent through the the local NIC and not via the SonicWALL default gateway. If I change the route to use the SonicWALL as the gateway I can ping Windows<-->VPN successfully, as expected:
route change 192.168.2.0 mask 255.255.255.0 192.168.2.254
So, although I have a workaround, it's not really practical (or desirable) to go around every Windows PC and force it to send all LAN traffic through the SonicWALL. Are there any other solutions?
- Whatever OSX and Ubuntu are doing when I ping the VPN device, they are managing to correctly route through the SonicWALL. Does OSX/Ubuntu always do this or are they being clever if the destination IP is not found on the physical LAN? Can Windows be made to do the same?
- Is it possible to make the SonicWALL respond to the L2TP pool addresses on the Physical LAN?
- Something else?