This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN connects, but doesn't route traffic or do much at all

I recently upgraded to ASG 7.500.  Prior to the upgrade, my SSL VPN worked fine; however, after the upgrade, it is no longer working properly.  I downloaded and installed the latest client from the user portal (for Windows 7 RTM x64), and ran it as Administrator.   It connects to my ASG and gives me an IP address from the VPN Pool (SSL), but it doesn't tunnel my network traffic through the VPN connection (for example, my external IP address does not change, like it used to when it was working properly).  The Astaro client shows that it connects properly and everything looks like it's working, but nothing actually happens with the network traffic.

I checked the network addresses and subnet masks of all other VPN Pools (Cisco, IPSec, L2TP, and PPTP) and they are all properly subnetted into non-conflicting and separate networks. (With a /24 subnet mask)

Under Network Security --> NAT, Masquerading, there is a rule to allow VPN Pool (SSL) -> External (WAN).  I have not changed any configuration settings--I have only upgraded to 7.500.

When I view the live SSL VPN log, it shows everything connecting properly and doesn't show any errors.  The last line shows "Peer Connection Initiated with x.x.x.x"

Could it be that my campus is blocking SSL VPN connections somehow?  If I understand correctly, they would have to block port 443 (which my ASG is configured to use for SSL VPN connections), which would also disallow secure connections to web sites, etc.

The problem exhibits itself on both Windows (with the Astaro/OpenVPN client) and Mac OS X using (using Tunnelblick).  I had the VPN working properly with Windows 7 RTM x64 before the upgrade to ASG 7.500.

Any suggestions would be greatly appreciated.

This thread was automatically locked due to age.

Parents

0 maxmosimann over 11 years ago

Hi bhall7 and readers!

Haha it's been 5 years since you posted this request!
I just bought a Astaro (now Sophos) Firewall and got the same problem as you did 5 years ago.
After reading this whole blog I found out what the problem is. The problem is as you already mentioned that the SSL VPN client doesn't receive a default gateway and hence doesn't know where to send it's DNS requests.
The solution all in all is very simple: just allow the SSL VPN network to access your DNS settings on the firewall. You'll find the settings under Network Services > DNS > Global

Hope this helps!
Cancel
Vote Up 0 Vote Down

Cancel
0 t-work over 11 years ago in reply to maxmosimann

Hi bhall7 and readers!
The problem is as you already mentioned that the SSL VPN client doesn't receive a default gateway and hence doesn't know where to send it's DNS requests.
The solution all in all is very simple: just allow the SSL VPN network to access your DNS settings on the firewall. You'll find the settings under Network Services > DNS > Global

Hope this helps!

Hi Maxmosimanm,
I think there are some reasons, why VPN could be "broken".
Of course you have to allow DNS for your VPN Clients if you want them to use DNS (;-)).
On the other hand you have to allow the traffic you want them to be allowed in Firewall or use autoconfig.
But I don't think this is the only possible reason.

The Sophos SSL VPN Client had Problems with missing admin rights in former versions, as well as problems to set routes after hard disconnecting - for example when a Notebook went to standby state. After waking up, still the old routes existed and if a new connection to the ASG (UTM) was build up AND the Client got another VPN-IP, connection were impossible.

Also there was a Problem with updates of the Client Software: sometimes it happened that a new installation (sophos) did not remove a service of the (astaro) client. Also, there STILL are problems sometimes with one of the two sophos/OpenVPN services starting at startup of the PC. If it fails starting, vpn won't work.

TIP to Sophos:
Please set the "startup recovery" Setting of your openvpn Service to "restart", not to "do nothing". At least two times it should try to restart the Service after booting.[:)]
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 t-work over 11 years ago in reply to maxmosimann

Hi bhall7 and readers!
The problem is as you already mentioned that the SSL VPN client doesn't receive a default gateway and hence doesn't know where to send it's DNS requests.
The solution all in all is very simple: just allow the SSL VPN network to access your DNS settings on the firewall. You'll find the settings under Network Services > DNS > Global

Hope this helps!

Hi Maxmosimanm,
I think there are some reasons, why VPN could be "broken".
Of course you have to allow DNS for your VPN Clients if you want them to use DNS (;-)).
On the other hand you have to allow the traffic you want them to be allowed in Firewall or use autoconfig.
But I don't think this is the only possible reason.

The Sophos SSL VPN Client had Problems with missing admin rights in former versions, as well as problems to set routes after hard disconnecting - for example when a Notebook went to standby state. After waking up, still the old routes existed and if a new connection to the ASG (UTM) was build up AND the Client got another VPN-IP, connection were impossible.

Also there was a Problem with updates of the Client Software: sometimes it happened that a new installation (sophos) did not remove a service of the (astaro) client. Also, there STILL are problems sometimes with one of the two sophos/OpenVPN services starting at startup of the PC. If it fails starting, vpn won't work.

TIP to Sophos:
Please set the "startup recovery" Setting of your openvpn Service to "restart", not to "do nothing". At least two times it should try to restart the Service after booting.[:)]
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data