This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

L2TP over IPSec Remote Access VPN Same Subnet

Hi,

I have a question about Remote Access VPN when the remote user’s LAN is within the range of the workplace LAN. We're on a Sophos UTM320 v9; our users are on Macintosh:

Our office subnet is 192.168.0.0/19 (long story; it was set up years ago before I got here and too much of a nightmare to try to change to something less “residential” at this point).

Our remote access users are put into the VPN Pool 10.242.3.0/24.

Now, if they are at home and connect to the VPN (and on Mac the “Send All Traffic Through VPN” is checked to prevent split tunnels), they can see resources if the resource they are looking for happens to not be in the range included in their home LAN.

Example: they can see 192.168.0.2 if their home LAN is in the 192.168.1.x range. If their home LAN is 192.168.0.x then they cannot because, I imagine, their home router will try to connect them with 192.168.0.2 at their house, not inside our LAN.

If I issue a command “sudo route add 192.168.0.2 10.242.3.1” on the computer it then works because it tells the computer to go THROUGH the VPN “gateway” to find the host.

My question is this: Why should this be necessary? Doesn’t the home router pass through the VPN traffic (if passthrough is enabled) to the UTM at 10.242.3.1? Why is the home router doing anything with any traffic from the computer other than handing it off to the VPN?

Thanks,

This thread was automatically locked due to age.

0 BAlfson over 9 years ago

The home router isn't the problem, the problem is the remote computer. If you can't change your subnetting, then the remote clients will have to change theirs.

Cheers - Bob

Sorry for any short responses. Posted from my iPhone.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 JeffCooper over 9 years ago in reply to BAlfson

Thanks. What's really strange is this hasn't been a problem (that anyone has mentioned) for years ... probably since we got our first utm in 2009. In the past month, EVERYONE seems to be having connection issues.

I understand the problem is with the home subnet being in (or within) the same subnet as the office, and that packets leaving the computer, aiming for 192.168.0.2 will attempt to get routed by their home router to a home IP address and not sent through the VPN. I think I can work around with with some "route add" commands I can applescript, but I'm still perplexed why "Send All Traffic through VPN" doesn't actually do that, which would effectively ignore the home router on it's way to the 10.242.3.1 "pool" (or virtual interface or whatever it is). I get that there still needs to be SOME sort of communication on the home side, otherwise WIFI wouldn't work, but you'd think (or maybe it's just me), anything going anywhere except the router/WAP would make a bee-line for the VPN.

Thanks,

Jeff
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

A router does not see the traffic between devices in the same subnet. Those devices know that the target IP is in their subnet, ARP for the MAC address of the local device and then send the packet directly to that MAC address. This takes precedence over any routes configured by the SSL VPN.

If it seems like the concepts are different in the UTM, they are not. It's just that you don't manipulate them directly at the command line. Remember that WebAdmin is a graphical interface used to manipulate a database of objects that is queried by the configuration daemon to write the command lines, configuration files, etc. used by the UTM. This is reflected in #2 in Rulz.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel