We've installed a Sonicwall TZ Firewall and have configured an L2TP/Ipsec VPN.

The SonicWall is connected to an internal router on the subnet with the SonicWall on and the internal router (a Dreytek Vigor) on

VPN clients are allocated to an L2TP range -

Finally there is an internal subnet on the Dreytek with a DNS and DHCP server on

I'm having a lot of trouble getting VPN clients to access the subnet. I've setup a static route on the SonicWall with the gateway I've also setup a static route on the Dreytek pointing the VPN subnet back to the gateway.

I can successfully ping VPN clients (e.g. and access shared networks resources on VPN clients from within the internal subnet but for the life of me I cannot access anything on the range from a VPN client.

I'm not sure if there is something I missing in regards to routing or if I need to open up permissions on the routers? I've tried adding static routes on the VPN clients themselves and this hasn't done anything. I've also setup what I think is the correct access rule on the SonicWall (Allow, VPN -> LAN, any source -> but still nothing.

Any ideas what I'm missing?

  • At this point I think you should be making heavy use of traceroute, tcpdump/wireshark. If you do a traceroute from a vpn device to where does it fail? What happens with a traceroute in the opposite direction. Once you figure out where it fails find a way to capture on that segment.
    – Zoredache
    Nov 17, 2018 at 1:08
  • It's failing on the dreytek (which is the very first hop). So does this mean that the dreytek is blocking the traffic? The reverse trace is just 2 hops from lan gateway ( to the client (in this case on Nov 17, 2018 at 1:45

2 Answers 2


Make sure in the sonicwall, in the VPN user configuration, that those users are allowed to access the 192.168.100.X network.

You did correctly by adding the firewall rules, but you have VPN policy too.

By default sonicwall will allow nothing to the vpn user, but if you choose All Firewalled subnet, the draytek range might not be into that security group, so add your draytek range to the user.


Thanks for the help guys, it turned out to be an issue with the access rules (a higher priority rule was blocking inbound wan traffic despite my rules allowing the vpn traffic).

To anyone else struggling, it was the packet monitor on the firewall that helped get to the bottom of it so I suggest you use that to debug the connection

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .