L2TP IPSEC - unable to access internal pages on iPhone, Works on Android.

Hi and welcome to the UTM Community!

Firewall rule #3 has no effect and should be deleted for clarity.  By definition, all traffic not specifically allowed is dropped by default, so #7 should also be deleted as it provides less information in the logs than does a default drop.

In the DNS picture, you can delete "Internal (Address)" as it is included in "Internal (Network)."

What do you mean by "cannot access" things - what would we see if we were in your place?  Are all devices connecting via WiFi?  Can you surf the Internet from all devices?

Cheers - Bob

Hi Bob

iPhone - VPN from a wifi with range 192.168.1.0/24 - Only internet works, but i can ping all the internal address

iPhone - VPN from a Wifi with a range 172.x.x.x or 10.x.x.x - everything works (Internet, Internal devices incl Sophos WebAdmin/User Portal)

iPhone - VPN from 3G/4G - everything works (access to Internet, Internal devices incl Sophos WebAdmin/User Portal)

Android - everything works regardless.

Thanks

What is your "Internal (Network)" subnet?

Cheers - Bob

192.168.1.0/24

That is the same subnet on both sides of the connection. That is generally not recommended, how would your client now know (or even be able) when to use it's local network and when to send to VPN for something in 192.168.1.0/24?

If it's not possible to change 1 of the 192.168.1.0 subnets, then you might need to configure NAT inside the VPN so you can use just another subnet for just the VPN-clients.

Edit:

Oh and by the way your last firewall rule not only is unnecessary but I think it will never ever apply since Any IPv4 as a source means any IPv4 traffic ORIGINATING from the internet going to Any IPv4, so going to any IPv4 address ON THE INTERNET.

Basically you disallow traffic coming from the internet going back to the internet through your firewall....

apijnappels said:

how would your client now know (or even be able) when to use it's local network and when to send to VPN for something in 192.168.1.0/24?

I thought the "Send all traffic" switch on the iPhone L2TP client will take care of this? Also i still dont understand how it works flawlessly on the Android.

apijnappels said:

If it's not possible to change 1 of the 192.168.1.0 subnets, then you might need to configure NAT inside the VPN so you can use just another subnet for just the VPN-clients.

Which type of NAT do i need 1:1 or SNAT?

Basic networking.  Try with the Android from the network with 192.168.1.0/24 where the iPhone had routing problems.  If that works, then the client in the Android is not working as it should.

Cheers - Bob

Basic networking.  Try with the Android from the network with 192.168.1.0/24 where the iPhone had routing problems.  If that works, then the client in the Android is not working as it should.

Cheers - Bob

yup tried and it works every time on android vs iphone which doesnt. very confusing why it works on android when it shouldnt