Skip to main content
Miata
Miata
New Member
May 18, 2015
Question

Losing Internet Access when Connected to VPN

  • May 18, 2015
  • 3 replies
  • 47065 views

Hi guys

 

When connecting via VPN the computer loses all internet access. I have tried with and without split tunnelling and nothing works.

Model: Fortigate 60D Firmware : 5.2.3

 

Anything I need to look at in regards to debugs/config? Do I need split tunneling?

 

I've had a look at other threads and come across this comment

 

'My firewall policy with the SSL-VPN set as action was this: wan1 > internal all - all - always - any -SSL VPN The destination must be a specific subnet(s) in order to do split tunneling. Once I changed my destination on that policy to the appropriate internal subnets, split tunneling worked just fine once I was able to enable it.'

 

Is this the general setup for this?

 

Cheers,

Miata

3 replies

Christopher_McMullan
Staff
Christopher_McMullan
Staff
May 18, 2015

If you enable split-tunnelling in the settings for the SSLVPN web portal, once you try to define a firewall policy for the connection afterwards, I think you will be prohibited from leaving the destination address zeroed. It is not a valid split-tunnelling address. So you could do either-or: leave the web portal and policy destination wide open and split-tunnelling disabled (but then create an ssl.<vdom> to WAN policy to allow Internet access), or else enable split-tunnelling in the Tunnel Mode widget in the SSLVPN web portal, choose a local address range, and make the destination in the policy the same address range.

 

The tricky part comes in if tunnel-mode users also want to use the web portal for proxied browsing to Internet sites. In that case, the only way I can find to make the scenario work is to create two portals: one Tunnel Mode (split tunnelling) and one Web Only. For the browsing web-only mode connection, you would need a second user account (and/or user group) to authenticate to it, since portal selection is based on authenticated identity. Once in that portal, you could not bring up a split-tunnelling Tunnel Mode connection, but you could browse via the portal proxy. And vice versa, for a tunnel connection, authenticate as the user for the Tunnel Mode portal.

 

Messy, but it works!

Miata
MiataAuthor
New Member
May 18, 2015

Hi

 

Thank you very much for this information, however do you know if this works with IPsec VPN? How can I set this up for that?

 

Cheers

Miata

Christopher_McMullan
Staff
Christopher_McMullan
Staff
May 19, 2015

With IPsec, it depends who the client will be for the connection. With FortiClient or a known OS (iOS, Windows, etc.), the wizard takes care of the options, and provides a drop-down field to choose split addresses.

 

Otherwise, the manual route will take you into the CLI:

config vpn ipsec phase1-interface

edit <phase1_name>

set ipv4-split-include <address_name>

...

end

Terms & ConditionsAccessibility statement