topic Re: Route Internet Traffic to Site over VPN Tunnel in General Topics

Route Internet Traffic to Site over VPN Tunnel

Theo — Mon, 09 Mar 2020 07:30:27 GMT

OS: R80.30

Type of Connection: Mobile Access

VPN Application: Capsule VPN (Android)

Target Application to Work: MS PowerApps

We have customized PowerApps project deployed/installed in tablet of our user in China. As we all know, even Microsoft apps are having problems when working inside China because of internet restriction. The PowerApps is working normally as tested out of China, what we did is we installed Capsule VPN to subject tablet and connect to our Headoffice.

The VPN tunnel established successfully, but PowerApps is still having problem syncing the data from tablet to server.

We want to route internet traffic of tablet after it successfully connect the VPN, is this possible? If yes, any lead/ ideas how to do? Also, just to add we have Proxy server in HQ and we're thinking of using it once the VPN has been established, not sure how to apply this in specific application in PowerApps or how the Android will use proxy once VPN is connected.

Re: Route Internet Traffic to Site over VPN Tunnel

mdjmcnally — Mon, 09 Mar 2020 07:57:09 GMT

I believe that you can still enable Hub Mode for the Capsule VPN Clients.

Global Properties / Remote Access / SecureClient Mobile

Security Settings - Route all traffic to gateway

Set to Yes

Also set this under Endpoint Connect as well.

Make sure that set NAT on the Office Mode range so that when connects to Internet that is NATed.

That should by my understanding have the VPN Client send the traffic over the VPN tunnel

Re: Route Internet Traffic to Site over VPN Tunnel

Wolfgang — Mon, 09 Mar 2020 08:03:27 GMT

Theo,

you can route all traffic via VPN to your central gateway:

As @mdjmcnally mentioned, you have to enable for this for the different clients, but I think you have to have to enable this here for the capsule VPN clients.

Wolfgang

Re: Route Internet Traffic to Site over VPN Tunnel

Theo — Wed, 11 Mar 2020 14:04:35 GMT

hi @mdjmcnally, are you referring to this article? https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101239

Re: "Make sure that set NAT on the Office Mode range so that when connects to Internet that is NATed." should i do this in the security gateway? i forgot to mentioned that security gateway uses HA/ cluster

Re: Route Internet Traffic to Site over VPN Tunnel

Theo — Wed, 11 Mar 2020 14:05:38 GMT

@Wolfgang my security gateway has this settings, but looks like the internet traffic is not routed to the gateway

Re: Route Internet Traffic to Site over VPN Tunnel

ikafka — Fri, 12 Jul 2024 06:34:29 GMT

I have a question. Is there a similar setting in IPSEC VPN to allow users in the branch office to access the internet from Check Point in HQ?

Re: Route Internet Traffic to Site over VPN Tunnel

PhoneBoy — Fri, 12 Jul 2024 13:41:14 GMT

Yes, it’s in the relevant VPN Community object.
Should be configured as a Star with VPN Routing configured with “To the center or through the center to other satellites, to the internet, and other VPN targets.”
See also: https://support.checkpoint.com/results/sk/sk182072

Re: Route Internet Traffic to Site over VPN Tunnel

ikafka — Sat, 13 Jul 2024 22:02:52 GMT

I guess we cannot do that in mesh topology.

Re: Route Internet Traffic to Site over VPN Tunnel

PhoneBoy — Mon, 15 Jul 2024 13:42:25 GMT

In a full mesh community, correct.
Multiple VPN communities may be required here to achieve the desired result.