Restricting Sonicwall SSL-VPN users for WAN access

• Apr 15, 2018

• #2

Moris53

Technical User

Apr 15, 2018

9

GB

I think you can actually do that, but I would like to know how myself.

 

Upvote 0 Downvote

• Apr 16, 2018

• #3

iggsterman

Technical User

Aug 21, 2011

250

US

I have not worked with Sonicwall so I can point you to the direction without specifics. What you are looking for is making sure you are running a split tunnel which means only specified networks (typically inside/LAN subnets) are routed through the tunnel. That will ensure that the remote users will use their own ISP for other (public) networks. You will need to add these specific public IP addresses to the list of split tunnel networks. The VPN will do the rest. To clarify further the VPN will inject routes to those IP addresses in the remote clients' routing tables.

 

Upvote 0 Downvote

• Apr 19, 2018

• Thread starter
• #4

Shmid

IS-IT--Management

Apr 11, 2018

5

ES

Hi thanks for your help.

The SSL-VPN "Client Routes" has "Tunnel All Mode" and is set to "Enabled". But if I disable it then test showed that the public IP used is the local user internet, but access to servers on the LAN at the destination site works. So it all works except we need remote users to access two public servers from the main site which is blocked from all other public IP's, hence the VPN. These two sites were blocked via VPN on the test as the source public IP is not the correct one. Hope this makes sense!

Not sure if this is possible to achieve.

 

Upvote 0 Downvote

• Apr 19, 2018

• #5

iggsterman

Technical User

Aug 21, 2011

250

US

If the LAN addresses work that means the appliance knows what the LAN IPs are. Add the public addresses there you will be good to go.

 

Upvote 0 Downvote

• Apr 19, 2018

• Thread starter
• #6

Shmid

IS-IT--Management

Apr 11, 2018

5

ES

The 2 public IP's are only accessible from the destination LAN, as they are only allowing access from the destination public IP, nowhere else. So the VPN connects then is able to see destination LAN devices and able to connect to the internet via clients IP. THis part works great. But because the client Public IP is seen when connecting via VPN and not the destination IP, hence gets blocked because the call to those IP's is coming from the clients public IP address. No need to add a route or access rule as the destination LAN is able to see the 2 IP's. This is the problem!

 

Upvote 0 Downvote

• Apr 19, 2018

• #7

iggsterman

Technical User

Aug 21, 2011

250

US

I keep telling you that ADDING the two IP addresses to the TUNNEL configuration so the VPN clients will receive the two /32 addresses INJECTED into their (clients) routing tables will do the job. The traffic to the two addresses will therefore be sent to the tunnel and not to the ISP, hit your LAN and then sent to the IPs while NATed the same way as your LAN. It is what you need, isn't it?

 

Upvote 0 Downvote

• May 2, 2018

• Thread starter
• #8

Shmid

IS-IT--Management

Apr 11, 2018

5

ES

I spoke to Sonicwall support on two ocassions with two different support agents and both have said this is not possible.
Thanks for you time anyway.

 

Upvote 0 Downvote