Okay, I'm about ready to strangle someone.

I finally break down and decide that the only way around this for sure is to just use their "GlobalVPN" client software.

It was the thing I wanted to avoid... using third party network clients. But oh well, we bought this thing and now we might as well use it. Right?

I find out this thing isn't licensed for any VPN users. At all. Licenses for the GlobalVPN client software cost extra.

I just bought the one Meatballman linked for me. That pricepoint doesn't include clients. ARGH.

That's what you get for ignoring my caveats.

It was the only product I'd seen with a specific instruction sheet on how to do exactly what I wanted to do: Have a windows client dial in to a VPN router. I can't believe something so simple is so fucking hard to find.

And even with a specific instruction sheet for it, even that doesnt work. Argh.

Keep in mind that this is after I'd already bought a Linksys router that was SUPPOSED to do the same thing but couldn't actually.

Okay, I'm rereading those instructions and they seem to make more sense now for some reason.

So you've successfully gotten remote clients to connect and get assigned 192.168.3.x addresses, right? And that's a separate pool from the .2 network that your in-office machines are on, right? So your problem at this point is that the routing doesn't work.

Let's investigate that.

I imagine that the routing from the .2 network to the .3 clients works fine because their default gateway is the SonicWall already. So your problem is probably that the clients don't know that the .2 network is on the other side of the VPN.

So let's veryify that quickly. Can you set it back up so that your client can connect? Then look at your routing table (route print). Then manually add a route that points the .2 network over the VPN connection. So that should look something like "route add 192.168.2.0 mask 255.255.255.0 192.168.3.x", where that last IP address is the SonicWall's address on the .3 network (which, hopefully, it has).

Then try to ping or something and see what happens. I know this isn't a good permanent solution, but at least you can see if this is what the problem is.

Consumer grade stuff doesn't do VPNs elegantly. And support is laughable at best.

I don't know sonicwall stuff at all, but I'm not encouraged from your experiences.

I've been very happy with the Watchguard stuff we use - it's relatively easy to configure, and has good support. I have 15 or so VPN tunnels between offices, and several roaming user connections (including an accountant in suburban London connecting back to our office in Alexandria, VA, and my laptop regularly from pretty much anywhere).

-jk

SonicWall claim not to be consumer grade.

Quote:
SonicWall claim not to be consumer grade.

I really meant the Linksys...

-jk

Okay, maybe I misunderstood.

You entered a range of addresses into the SonicWall to be the ones handed out to VPN clients, right? And the VPN clients are successfully getting those IP addresses, right?

Does the SonicWall have an IP address in that range? If you can't see it configured anywhere, maybe you could ping all the addresses in that subnet and see if any other than the one configured on the client itself responds. If so, that's probably the SonicWall.

Hmm. Maybe I should take another tack and get you to post information extracted from the systems and find out whats going on. First let's get info from the VPN client.

Get a VPN client going and then post the output from "route print" and "ipconfig /all". Also try to ping one of your internal IP addresses and then do a "tracert" to that same address. Post all of that info and let's see where that leads us.

Oh, and as far as the NAT thing goes, google for l2tp and "nat traversal". That should provide some information. At the same time, let's just attack one problem at a time.

Yeah, ok, the current plan is to just bite the bullet and buy the client licenses for their proprietary VPN client software, and not worry about this any more.

Thanks for all your help, Bitt, and everyone else.

See? That's how they getcha!

You have no idea. Client licenses for this thing are expensive.

But on the good side, the client software is super-easy to install and configure. It prompts them for the IP address, the preshared key, the user name, and the password, and bam they're in. No setups involving digging into the Windows configuration dialog boxes. This is a big bonus because the plan is to have some people installing this stuff who aren't necessarily very computer-literate. So I think it's worth it in this case.

Tony,
I support Sonicwall VPN with three users who don't know Outlook from Outlook Express and I've had no problems with the client software from SW, fwiw.

-Zeke

Thanks, that's good to know.