0

We have a remote office with several users. The users connect to the cable modem there and individually VPN to our NSA2650 via Sonicwall Global VPN client. This client is set to tunnel-all mode because of cookie and session stuff. Unfortunately, when the VPN is connected, the local printer at the remote office is not accessible because all of the traffic is being tunneled. The VPN client takes over the network interface and not even pinging the printer works. I got on with support and they said it was impossible. It looks like other manufacturers have split-tunnel or similar functionality, but Sonicwall support confirmed there was no way to do something similar with their firewall.

Is there a way to create a static or other route on the machines that would allow traffic to reach the printer while the VPN is connected? NB: the VPN and LANs are on different subnets.

Improve this question
6
  • 1
    "Is there a way to create a static or other route on the machines that would allow traffic to reach the printer while the VPN is connected?" That is split tunneling, and if the VPN does not support it, then you cannot access any local devices.
    – Ron Maupin ♦
    Nov 10, 2022 at 17:33
  • So the route configuration on the machine has no bearing nor any way to override what the VPN client is doing?
    – stormdrain
    Nov 10, 2022 at 19:51
  • The VPN client gets its orders from the firewall, and it will look for routing table changes on the host and remove them while it is running.
    – Ron Maupin ♦
    Nov 10, 2022 at 20:01
  • And it's safe to assume that those instructions are updated regularly while the client is running so that any changes made to the routing table after the client is started are going to be overwritten by the client soon after they are made? Thanks for your help.
    – stormdrain
    Nov 10, 2022 at 20:31
  • Yes. You can make and use routing table changes while not connected to the VPN, but the VPN client software monitors and reverses any changes while it is running, Split tunneling is a security risk because it opens a hole in the firewall for the business that can be exploited on purpose of by accident.
    – Ron Maupin ♦
    Nov 10, 2022 at 20:34

2 Answers 2

Reset to default
0

Sonicwall is 100% wrong. Their own documentation shows easy instructions to enable split tunnel.

NETWORK | SSL VPN | Client Settings screen, configure Default Device Profile. https://www.sonicwall.com/support/knowledge-base/how-can-i-allow-sslvpn-users-access-to-the-internet-when-using-tunnel-all-mode/170505877560278/

https://www.sonicwall.com/support/knowledge-base/how-can-i-configure-ipsec-client-based-vpn-for-remote-users/170505850768290/

Improve this answer
2
  • Thanks, but that is using the SSL VPN config/client which isn't the same as the Global VPN client. The global VPN client uses either wireguard or ipsec and neither link has relevant info. The first link seems to just describe how to allow access to the internet which is not my issue, we can already access the internet and it is tunneled as we want. The second link just describes how to set up the Global VPN connection, it doesn't say anything about printing locally with tunnel all mode on.
    – stormdrain
    Nov 10, 2022 at 19:53
  • Edit: I see now in the second link, the section on client connections, in the dropdown, set "allow connections to" and set "split tunnels". I will try once people disconnect for the day. Thanks and sorry for not reading more carefully earlier. I still am not clear on how the first link fits in, I don't see Network > SSLVPN config, and in the SSLVPN > Client settings config, I don't see anything about split tunnels...the link seems to just describe how to turn on tunnel all mode and add WAN remote access networks to allow internet which I already have.
    – stormdrain
    Nov 10, 2022 at 20:16
0

It seems that somehow and for some reason, enabling ipv6 (it was disabled before) allows the printer to be discovered, added and printed to while the VPN is connected.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.