topic Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway in Spark Firewall (SMB)

Remote Access VPN Clients has no Internet Access when routing through the Gateway

jyrbn — Wed, 23 Apr 2025 07:34:36 GMT

Hi,

We are trying to configure Remote Access VPN on a Centrally Managed (Smart-1 Cloud) Spark 1600, when routing all traffic through the security gateway, remote access clients can ping and access Internal Networks but has no Internet access which is need to access our cloud resources.

We have followed this sk but are still not successful https://support.checkpoint.com/results/sk/sk101239.

Any ideas on what we could check?

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

G_W_Albrecht — Wed, 23 Apr 2025 08:35:26 GMT

Did you configure this also in rule base ?

As written in https://sc1.checkpoint.com/documents/R80.10_andhigher/WebAdminGuides/EN/CP_RemoteAccessVPN_AdminGuide/14605.htm#o165153

Create the access control rule in the Access Control Policy.

VPN routing traffic is handled in the Security Policy Rule Base as a single connection, matched to one rule only.

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

jyrbn — Wed, 23 Apr 2025 09:06:19 GMT

Which part of the documentation you sent are you referring to?

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

G_W_Albrecht — Wed, 23 Apr 2025 09:12:20 GMT

See the included link !

Hub Mode for Remote Access Clients

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

jyrbn — Thu, 24 Apr 2025 07:08:19 GMT

Yup, we've already enabled hub mode for the clients.

Whenever I enable VPN tunneling (Routing traffic through the gateway) on the client even my own internet connection becomes "No Internet Access".

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

G_W_Albrecht — Thu, 24 Apr 2025 07:13:05 GMT

No, i am talking about the rule base - RA clients are restricted by the rule base that tells which networks they can access.

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

G_W_Albrecht — Thu, 24 Apr 2025 07:15:28 GMT

Why would you use hub mode at all ? Seems you usually have your private internet connection, so using endpoint security would be safe in all situations; with hub mode, you have the TP GW only when connected thru RA VPN.

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

jyrbn — Thu, 24 Apr 2025 08:44:33 GMT

Ah yes, we have also configured a rule for remote access clients.

It's destination is currently set to ANY for testing purposes.

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

jyrbn — Thu, 24 Apr 2025 09:14:16 GMT

Our remote access clients needs to access our cloud resources using the Public IP address of our GW because that IP address is the one authorized to access them. That's why we need to route all traffic of the remote clients thru our GW.

Re: Remote Access VPN Clients has no Internet Access when routing through the Gateway

PhoneBoy — Fri, 25 Apr 2025 13:06:58 GMT

Do you see anything in the logs when the Remote Access client connects and attempts to communicate?