Environment: A company network has a Firebox M-series appliance with Total Security Suite at headquarters. Every branch office has a smaller T-series Firebox without subscription services. For this reason, all traffic from the branch offices is routed through the M-series appliance at headquarters. Some of the branch office Fireboxes has a static IP, some obtains it via DHCP.

Occasionally there might be some problems with the tunnel (for example if the HQ network is down). Therefore, the branch office Fireboxes need to be able to abandon the route through the tunnel and work standalone for a while, since BO Internet connectivity is crucial for the business. This works with BO Virtual Interface, but not with over BO GW & Tunnel.

Simplified (just one External and Trusted if) related configuration, a branch office with DHCP.

  • Firebox-HQ ( - M670 [Fireware OS v12.2.1.B572649]
    • Interfaces (Routed Mode)
      • eth0: ISP1 [External] - (Static)
      • eth1: Trusted [Trusted] -
    • VPN Interface (bvpn20): BovpnVif.BO20 [IKEv1]
      • Route to
  • Firebox-BO20 ( - T55 [Fireware OS v12.2.1.B572649]
    • Interfaces (Routed Mode)
      • DNS Servers: & (ISP2's DNS servers)
      • eth0: ISP2 [External] - (DHCP)
      • eth1: Trusted [Trusted] -
    • VPN Interface (bvpn1): BovpnVif.HQ [IKEv1]
      • Route to
      • VPN Settings: [x] Remove VPN routes when the tunnel for a BOVPN vif is down.

Everything works just as expected when the tunnel is down. The Firebox-BO20 can work as a DNS resolver for its eth1 network. Both and Firebox itself can access the Internet.

Problem: When the tunnel is up and the route through bvpn1 is added, the clients on eth1 can access the Internet through the VPN and all the resources (incl. DNS servers) at the HQ.

IPv4 Routes
Destination     Gateway         Genmask         Flags   Metric    Interface         U       1         bvpn1         UG      5         eth0   U       0         eth1   U       0         eth0       U       0         lo           

However, Firebox stops working as a DNS resolver and loses its own Internet connectivity. This is due to the fact that Firebox own connections starts to use the route, too.

  • The ISP2's DNS servers & aren't accessible from ISP1.
  • The devices on network can access the Internet through bvpn1.
  • Firebox doesn't use its internal IP through the tunnel, but
  • The Firewall rule Any From Firebox-00 is hard-coded and doesn't show up in Policy Manager. Otherwise it would have been easy to force it to use eth0 with <policy-routing>.

There are firewall policies to allow all the necessary traffic on both appliances; the problem is therefore delimited to the routing, alone.


For the ISP2's DNS servers you need to add static routes to Firebox-BO20.

  • From the Fireware Polixy Manager > Network > Routes...
    • Add... Static Route, Host IPv4, to, gateway metric 0.
    • Add... Static Route, Host IPv4, to, gateway metric 0.

After saving the settings to Firebox, the route table with tunnel connected looks like this:

IPv4 Routes
Destination     Gateway         Genmask         Flags   Metric    Interface         U       1         bvpn1         UG      5         eth0   U       0         eth1 UGH     0         eth0 UGH     0         eth0   U       0         eth0       U       0         lo          

Another option is to use public DNS servers (like Cloudflare's / or Google's / that works on both ISPs. This way you won't need to add the routes on Firebox-BO20, but the solution below is mandatory for both approaches.

For the Internet connectivity of the Firebox-BO20 when the tunnel is connected things are a bit more complicated, as the Firebox uses its external IP when sending its packets through the tunnel. If you have a matching rule with logging on, like a HTTPS proxy, you'll see this from the logs, e.g.:

Allow https/tcp 46452 443 BovpnVif.BO20-bvpn20 ISP1 
    HTTPS Request   (HTTPS-proxy-00) HTTPS-Client.Standard proc_id="https-proxy" 
    ... sni="services.watchguard.com" cn="services.watchguard.com" 

This has a route on the Firebox-BO20, but no route on Firebox-HQ tunnel bvpn20.

  • You need to edit the BOVPN Virtual Interface BovpnVif.BO20 and add a route to the external IP of Firebox-BO20. If the IP was static, that would have been a single

    In this case where the external interface of Firebox-BO20 is on DHCP you'd need a route that covers all the possible IPs it could get, the whole DHCP pool e.g. Of course this means that Firebox-HQ will use this route for the other addresses on that range, too. That may cause problem on some use cases – if it does, you need to get a static IP.

  • By default, Firebox adds dynamic NATs for private networks, and As the external IP is not within these networks, you need to add (Network > NAT...) Dynamic NAT from BovpnVif.BO20 to Any-External. Luckily this can be done using the existing built-in alias for the BOVPN Virtual Interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.