I have a VPN between 2 sites connected by a private link point to point. Now I need to find a way how to allow the Internet Traffic from branch Through the main Firewall.

I am using Sonicwall tz 300 in the branch and a NSA 3600 in the HQ.

I will need an static route (default route) from Branch to HQ. But not sure what kind of policies I need in the HQ to make this configuration (NAT and firewall policies)

  • I'm not sure you need to do anything beyond the default route at the branch. If the branch and headquarters are already communicating through the VPN, then things should probably work. – Ron Maupin May 29 '16 at 8:29
  • Did an answer help you? If so, you should accept it so that the question doesn't keep popping up forever, looking for an answer. You can also post your own answer and accept it if you found your own solution. – Ron Maupin Jul 24 '17 at 13:19

HQ firewall:
Independent of the firewall vendor, you will need an additional policy to allow traffic from the tunnel end to your WAN port (destination address 'all'). Here, you have to apply source NAT as private addresses like those used on the branch network are not routed over the internet. In a stateful firewall, reply traffic will be automatically allowed to flow from WAN port to the tunnel and eventually to the branch LAN.

branch firewall:
As you have already stated on the branch router/firewall you need an additional default route pointing to the (private) address of the HQ firewall. The associated policy should allow 'all' as destinations, not only the private address range of the HQ, as it might do at the moment.

On the branch firewall, you need an additional (host) route to the public address of the HQ firewall. Otherwise, this address cannot be reached when the tunnel is down. For example, add "" via WAN port.
If you already have a default route in place (pointing to WAN port) then either delete it or make sure it has a higher distance than the new default route to the tunnel.

| improve this answer | |

If it's a private link do you really need to encrypt? Maybe so? Just asking.

If so, you need to disable split tunneling on the branch sites VPN/Security appliance. Other than that just a default route pointing to the VPN peer (HQ) should do it. Oh, and you'll need to have a route back to the branch subnets in the HQ devices so they know how to route packets. The allowing of particular destination subnets to traverse the VPN tunnel may also be required to be configured.

| improve this answer | |
  • Where is that option disable split tunneling ? – GersonEx May 31 '16 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.