Internet access through VPN

[Jason Luckett]

Hi all

I have configured my 7102dl at home for VPN access, but can't seem to get internet access to work when I have VPN'd into my home network.

I can get internet access out when on the local LAN, I have set up the 7102dl to do DHCP and DNS Proxy.

I can access and ping everything on the network when VPN'd in but can't get the internet working.

I have attached my config for you to have a look at.

any help would be gratefully appreciated.

Regards,

Jase

[Mohieddin Kharnoub]

Hi

Once you get VPN connect you will get an IP in this range: 192.168.1.1 - 254, and DNS 192.168.0.1 , and if you notice that the ACLs control your interfaces.

The Public policy controls your VPN, and notice that it won;t allow your traffic through VPN to Internet, but only to LAN.

In the ACL VPN-to-LAN you can notice that :
ip access-list extended VPN-to-LAN
permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255

I believe if you add this line:
permit ip 192.168.1.0 0.0.0.255 0.0.0.0 0.0.0.0

or
permit ip any any

Unless you have some other security reasons not to allow VPN users to go anywhere, this line will solve your problem -i believe so :)

Good Luck !!!

[Matt Hobbs]

The problem is that the "nat source list Internet interface ppp 1 overload" belongs to ACP Private, which belongs to eth 0/1.

To me it seems like you would need to setup a new nat source line to go into the Public ACP since the VPN doesn't really have it's own interface to apply it to. Not sure if that will work or not though.

Most setups will have a proxy server for Internet access for users once they have VPN'd in.

Alternatively, depending on the VPN client you're using some can do split tunneling, the traffic that needs to go to the VPN will go through the VPN, and traffic that needs to go to the Internet will go straight out.

It's an interesting problem though and something I want to try out myself in the near future.

[OLARU Dan]

Or you might try to reserve in DHCP one IP that will be assigned to your computer when it connects inside, and use that IP only to get to internet, for instance:

permit ip host 192.168.1.10 any

[Jason Luckett]

Hi Mohieddin,

I changed the ACL to add the access to any, like you said but it still does not work,

I will try what Matt has sugested, and see if that works.

Many thanks for your input though.

Regards,

Jase