1

We've installed a Sonicwall TZ Firewall and have configured an L2TP/Ipsec VPN.

The SonicWall is connected to an internal router on the subnet 192.168.168.0/30 with the SonicWall on 192.168.168.1 and the internal router (a Dreytek Vigor) on 192.168.168.2

VPN clients are allocated to an L2TP range 10.10.20.10 - 10.10.20.49

Finally there is an internal subnet 192.168.100.0/24 on the Dreytek with a DNS and DHCP server on 192.168.100.63.

I'm having a lot of trouble getting VPN clients to access the 192.168.100.0/24 subnet. I've setup a static route on the SonicWall with the gateway 192.168.168.2. I've also setup a static route on the Dreytek pointing the VPN subnet 10.10.20.0/24 back to the 192.168.168.1 gateway.

I can successfully ping VPN clients (e.g. 10.10.20.11) and access shared networks resources on VPN clients from within the internal subnet but for the life of me I cannot access anything on the 192.168.100.0 range from a VPN client.

I'm not sure if there is something I missing in regards to routing or if I need to open up permissions on the routers? I've tried adding static routes on the VPN clients themselves and this hasn't done anything. I've also setup what I think is the correct access rule on the SonicWall (Allow, VPN -> LAN, any source -> 192.168.100.0) but still nothing.

Any ideas what I'm missing?

Improve this question
2
  • At this point I think you should be making heavy use of traceroute, tcpdump/wireshark. If you do a traceroute from a vpn device to 192.168.100.0 where does it fail? What happens with a traceroute in the opposite direction. Once you figure out where it fails find a way to capture on that segment.
    – Zoredache
    Nov 17, 2018 at 1:08
  • It's failing on the dreytek 192.168.168.2 (which is the very first hop). So does this mean that the dreytek is blocking the traffic? The reverse trace is just 2 hops from lan gateway (192.168.100.1 to the client (in this case on 10.10.20.15)
    – Olly Lennox
    Nov 17, 2018 at 1:45

2 Answers 2

Reset to default
1

Make sure in the sonicwall, in the VPN user configuration, that those users are allowed to access the 192.168.100.X network.

You did correctly by adding the firewall rules, but you have VPN policy too.

By default sonicwall will allow nothing to the vpn user, but if you choose All Firewalled subnet, the draytek range might not be into that security group, so add your draytek range to the user.

Improve this answer
0

Thanks for the help guys, it turned out to be an issue with the access rules (a higher priority rule was blocking inbound wan traffic despite my rules allowing the vpn traffic).

To anyone else struggling, it was the packet monitor on the firewall that helped get to the bottom of it so I suggest you use that to debug the connection

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.