Troubleshooting SSL VPN Connection UTM 9.5

Hi Darren and welcome to the UTM Community!

Lots of possibilities - let's start with a picture of the 'Server Settings' box from 'Remote Access >> SSL VPN'.

Cheers - Bob
PS I moved this thread to here from the General Discussion forum.

Hi Bob and thanks.

Please see the picture as requested:

Thanks,

Darren

It's not Bob no. We have "SSL VPN Users (User Group Network)" in there...

Darren

What happens if you replace that object with "VPN Pool (SSL)," Darren?

Cheers - Bob

I've not had a chance to make the change as yet Bob. I'll hopefully do it over the weekend sometime so will let you know how it goes.

Thanks again.

Darre

Hi Bob,

I made that change and tested, but it made no difference I'm afraid.

Thanks,

Darren

What does vpn.yourcompany.co.uk resolve to inside this WiFi network?

Cheers - Bob

It can't be resolved. I get the following from the client:

"Server: UnKnown

*** Server UnKnown can't find vpn.keelys.co.uk: No response from server."

If I do a dns lookup from the UTM itself, this also fails:

Trying "vpn.keelys.co.uk"

Host vpn.keelys.co.uk not found: 3(NXDOMAIN)

Received 84 bytes from 127.0.0.1#53 in 0 ms

Received 84 bytes from 127.0.0.1#53 in 0 ms

Thanks,

Darren

How does your configuration compare to DNS best practice?

Cheers - Bob

I've made a couple of changes Bob in line with the best practices, but still no luck.

I'm beginning to wonder if the issue could be linked to our internal domain name being the same as our external (i.e. keelys.co.uk)!?

Regards

Darren

I can see how that might affect your accesses, but not how your guest's attempt to get out would be affected.

If you want the internal users to get DNS resolution for your domain that differs from your public authoritative name server, you need a Forward Lookup Zone in your internal DNS server or to have the UTM provide this.  For example, I might have your domain used as the DNS Hostname in a Host object that points at the IP of "Internal (Address)" - that would fix your SSL VPN testing needs.

Still, the fact that the guest couldn't get out seems to indicate that the WiFi network is not allowed DNS access.

Cheers - Bob

Thanks Bob. I'll give your suggestion a try for our internal VPN testing.

With regards to guests VPN access out, I won't be able to test this until we have another guests come in I suppose. Unless if I connect a laptop to our guest wifi and try to connect to our vpn (so technically would be outside of our LAN)... Would that suit as a test do you think? Internet access all seems to work fine for devices on the guest wifi and I can't see any traffic being blocked/dropped on that network when vpn's attempt to connect. So that's why I'm a bit lost...

Thanks as always Bob.

Thanks Bob. I'll give your suggestion a try for our internal VPN testing.

With regards to guests VPN access out, I won't be able to test this until we have another guests come in I suppose. Unless if I connect a laptop to our guest wifi and try to connect to our vpn (so technically would be outside of our LAN)... Would that suit as a test do you think? Internet access all seems to work fine for devices on the guest wifi and I can't see any traffic being blocked/dropped on that network when vpn's attempt to connect. So that's why I'm a bit lost...

Thanks as always Bob.