The pfSense Store

Author Topic: [SOLVED] Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]  (Read 74917 times)

0 Members and 1 Guest are viewing this topic.

Offline mayesjc

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
I need to be able to use a SonicWall VPN client in order to access the VPN host at work.  The client works fine if I connect directly to the cable modem.  Otherwise, it will not connect, at all.

The message from the SonicWall Virtual Adapter is simply "connecting" and the log reads that the peer is not responding.  Specifically, it reads "The peer is not responding to phase 1 ISAKMP requests."

I have tried to configure NAT and the firewall rules to allow all connections to and from the client when inside the firewall.  Specifically, I have created a firewall rule on the LAN to allow all outbound traffic to the VPN server ip address.  I have created a similar rule on the WAN to allow all inbound traffic from the VPN server ip address.  I have used NAT to forward all inbound TCP/UDP protocol traffic on port 4500 (Ipsec NAT-T), GRE protocol traffic, and UDP protocol traffic on port 500 (ISAKMP) to the same client.  Naturally, when I created those NAT guidelines, firewall rules allowing the related traffic were also made.

Looking at the log files, I will sometimes see references to blocked traffic on random ports from the VPN server, despite the aforementioned rules.  Unfortunately, due to another, unrelated issue, my log files are filled almost immediately with garbage and therefore difficult to track specific errors.

I have done a good deal of research on this topic, and understand that there may be issues with Cisco ipsec VPN clients behind the firewall.  However, those issues mostly deal with multiple clients trying to connect to a remote VPN host, not my case where only one client needs to connect.  The solution must be there, or others would not need to ask about multiple clients.

I am using pfsense 1.2.3-RC1.  The SonicWall client is on a WindowsXP laptop.

I will be very happy to pay the bounty if someone will walk me through the configuration steps to the point that I can connect to the VPN server with my client from behind the firewall.
« Last Edit: August 13, 2009, 09:39:20 pm by mayesjc »

Offline Evgeny

  • Hero Member
  • *****
  • Posts: 1808
  • Karma: +1/-1
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [$150]
« Reply #1 on: August 11, 2009, 07:26:03 pm »
what are the versions of sonicwall client and sonicwall firewall?

Offline mayesjc

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [$150]
« Reply #2 on: August 11, 2009, 09:30:46 pm »
Does this help?  It is from the log file:

Application Name:               SonicWALL Global VPN Client
Application Version:            4.0.0.830
IPsec Driver Name:              RCFOX IPSec Driver
IPsec Driver Version:           10.0.7.31
Virtual Adapter Driver Name:    SonicWALL VPN Adapter
Virtual Adapter Driver Version: 9.0.3.2
DNE Adapter Driver Name:        Deterministic Network Enhancer
DNE Adapter Driver Version:     3.21.2.16899
Reported Generated At:          21:54:13 Thu Jul 09 2009 GMT

System Summary
    OS Name:                    Microsoft Windows XP
    System Name:                5.1.2600 Service Pack 2 Build 2600
    OS Manufacturer:            Microsoft Corporation
    System Name:                PC-ONT-006
    System Manufacturer:        PC-ONT-006
    System Model:               PC-ONT-006
    System Type:                X86-based PC
    Processor:                  x86 Family 6 Model 23 Stepping 6 GenuineIntel ~2393 Mhz
    BIOS Version:               06/16/08
    Windows Directory:          C:\WINDOWS
    Locale:                     United States
    Time Zone:                  Pacific Daylight Time
    Total Physical Memory:      2014 MB
    Available Physical Memory:  1363 MB
    Total Virtual Memory:       2047 MB
    Available Virtual Memory:   1972 MB
    Page File Space:            1861 MB

Offline Meulator

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +0/-0
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #3 on: August 13, 2009, 05:52:53 am »
Hello,

I don't have any trouble using VPN client on WIFI, behind a Pfsense box with captive portal up ; I got trouble as soon as i enable the traffic shapper, all is running VERY slow, or even not connecting.

Pfsense 1.2.2
WinVista sp1 / Xp SP3
Vpn client 4.0.0.xxx


Offline mayesjc

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #4 on: August 13, 2009, 01:24:13 pm »
Meulator--

Naturally, it is great to hear that you are not having my problem because it means that a solution is possible.  However, that fact alone does not help me with my configuration issues.  Would you mind explaining how you are set up?

Or, perhaps someone can earn the bounty by addressing the issues raised in my original post. 

Thanks.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21404
  • Karma: +1437/-26
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #5 on: August 13, 2009, 02:11:44 pm »
Are you using manual outbound NAT?

If so, have you tried turning on static port on the outbound NAT rule?
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline mayesjc

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #6 on: August 13, 2009, 02:59:58 pm »
At one time, I selected "Manual Outbound NAT . . . ." and then set up a mapping on the WAN interface, for source port 500 with static port enabled.  However, it did not work and no other host could get out either.  On reflection, I must have been tired because it would not make sense.

What is the best way to configure Advance Outbound NAT with Static Port enabled?  It would seem that there should be a mapping to allow normal outbound traffic by the other hosts.  I am not sure how that would be established.  Does there also need to be another mapping to allow the VPN client?  Is Static Mapping enabled in both cases?  I will try different configurations of this later tonight, when I am behind the pfsense firewall.  In the interim, if you have any tips that will speed it up, I would appreciate it.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21404
  • Karma: +1437/-26
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #7 on: August 13, 2009, 03:31:08 pm »
With automatic outbound NAT, it should be doing static port for IPsec automatically.

Otherwise you just make a new outbound NAT rule that looks like the default, and set it for destination port 500 and check the box for static port and that should do it.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline mayesjc

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #8 on: August 13, 2009, 03:41:17 pm »
If I am using Automatic outbound NAT rule generation (IPsec passthrough) already, which if I understand you correctly should be doing static port for IPsec automatically, what can I gain by switching to manual outbound NAT rule generation?  As I said, I tried that once, customizing the default outbound NAT rule to allow all traffic from any host originating on port 500 to go to any destination, but it did not allow the VPN client and also stopped normal traffic on all hosts.

I will try it again if you think it should work.  Again, do I need two manual rules:  One for default traffic and one for destination port 500?

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21404
  • Karma: +1437/-26
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #9 on: August 13, 2009, 03:50:34 pm »
Yes, you'd need two manual rules, one for all traffic, and one up above that for port udp/500, or whatever other ports that the sonicwall client might use.

You won't gain much against automatic outbound NAT if it's just for port 500/5060, which are static port already with that setup.

You might try using tcpdump to watch the traffic flow and see if you spot any oddities that way, especially if it's using an alternate port or some other technique. I don't remember much of anything about the sonicwall client, I don't know if it uses the usual ports or what.

I've seen VPN clients use port 10000, 4500, 500, etc. So looking at their traffic is the only way to find out what it is trying to do.

If it's IPsec, tcpdump can always show you how far it's making it in the negotiation.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline Evgeny

  • Hero Member
  • *****
  • Posts: 1808
  • Karma: +1/-1
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #10 on: August 13, 2009, 04:59:54 pm »
Indeed we have a problem here. Sonicwall client sends ISAKMP packets (UDP port 500) but in weird way.
Every packet is fragmented into two - 1314 and 162 bytes on wire. These packets do not go through pfSense.

Offline ermal

  • Hero Member
  • *****
  • Posts: 3832
  • Karma: +85/-5
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #11 on: August 13, 2009, 05:23:06 pm »
Disable scrub?

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21404
  • Karma: +1437/-26
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #12 on: August 13, 2009, 05:27:24 pm »
Indeed we have a problem here. Sonicwall client sends ISAKMP packets (UDP port 500) but in weird way.
Every packet is fragmented into two - 1314 and 162 bytes on wire. These packets do not go through pfSense.

Try lowering your LAN MTU or the MTU on the client system.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline Evgeny

  • Hero Member
  • *****
  • Posts: 1808
  • Karma: +1/-1
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #13 on: August 13, 2009, 05:29:56 pm »
Probably it would help but all flags in IP packets seem to be correct (do not fragment flag is not set).
I can't do it on production firewall. What is interesting on pfSense-1.0.1 SonicWall works (just tested)!! Completely confused...
Edited: I was talking about scrub.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21404
  • Karma: +1437/-26
    • View Profile
Re: Solution to SonicWall VPN Client Behind pfsense [Now Up To $200]
« Reply #14 on: August 13, 2009, 05:32:55 pm »
Have you also tried to enable NAT-T on the Sonicwall and in the client?
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!