In sonicwall devices they have routing policies to direct traffic flow to specific areas when trying to reach specific IP’s. If you are connecting to the site with a sonicwall vpn, that traffic can not read these rules. So, for example, we have the need to traverse a VPN from the client site to access a database. Users in the office have zero issue reaching this destination with the correct routing rules, but the vpn allowed traffic through the sonicwall vpn does not read that rule, so the database destination is unknown. So everyone on location reads the rule that says if you are looking for any ip in the 192.168.1.0/24 range, then go out this interface with this ip gateway, however the remote user who is connected to site via VPN doesn’t get that. I even tried setting route rules on the pc, but to no avail. Is this not possible or more likely, am I overlooking something? Our users can’t even use this VPN service if they can’t see these routes.
Are you advertising the routes to the client (there is a tab for for that)
If you use the “send all traffic to peer GW) does it fix it. Does the DB server have a route back the VPN IP range defined ?
Just a thought. Aside from the need to assign IP routes to the users on the SonicWall to allow that route to be published to them, is your reference to 192.168.1.0/24 actually what your servers/routes/configs etc are?
Because if so I’d be wanting to look at users that are having issues over the VPN and seeing what their home networks are set up as. Anyone that has a 192.168.1.0/24 home network is likely going to have issues on that. I had it on my VPN recently because one of our factory devices is on a segregated 192.168.1.x network and I’d given myself that as a VPN route to do various maintenance. If I was connected to the VPN I couldn’t then print to my home printer on a 192.168.1.x address
If your DB destination is 192.168.1.x then you’re going to have a bad time since that’s the internal addressing for most home routers. Of course they wouldn’t be able to reach that remote route since the adapter would see it as a locally connected network, not a network across a VPN tunnel.
If that’s not the actual subnet of your DB, then different investigation would be in order.
Also, is this Global VPN or SSLVPN? We don’t use the Global VPN client, only the SSLVPN client, but SSLVPN absolutely follows policy routing. I will add that we do “Tunnel All” for all SSLVPN users.
For “send all traffic to peer GW”, we did try it, the problem isn’t getting into the network, it getting the networked VPN traffic to read the route policy.
For the other question, we don’t have access to the DB servers routes (external vendor), I’m going to schedule a call with them and ask them this question though.
EDIT : One of my techs spoke with Sonicwall support, who said vpn clients can’t read policy routes. But I can’t imagine with all the remote VPN workers these days that there isn’t a way to accomplish this
that is likely your issue the DB servers either have ACL/Firewalls that prohibit the VPN pool, or lack a route back to it. Very common.
Here is what Chat GPT has to say about it lol
VPN clients connected to a SonicWall firewall typically cannot directly interact with or read policy-based routing configurations that are defined on the SonicWall device. Here’s a bit more detail on how this works:
Policy Routing vs. VPN Routing:
Policy routes on a SonicWall device are used to make routing decisions based on criteria such as source address, destination address, service type, and interface. These policies direct how traffic should be handled as it moves through the firewall and are primarily applied to traffic directly managed by the firewall itself.
VPN routing, however, involves how traffic from VPN clients is handled. While the VPN client traffic passes through the firewall, it does not inherently abide by the same routing policies set for regular network traffic. Instead, it follows the VPN policies and the routing configuration specific to VPN connections