Products
- Network Security
  - Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
  - Security ServicesComprehensive security for your network security solution
  - Capture Security applianceAdvanced Threat Protection for modern threat landscape
  - Network Security ManagerModern Security Management for today’s security landscape
- Access Security
  - Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
  - Secure Mobile AccessRemote, best-in-class, secure access
  - Wireless Access PointsEasy to manage, fast and secure Wi-FI
  - SwitchesHigh-speed network switching for business connectivity
- Email Security
  - Email SecurityProtect against today’s advanced email threats
- Cloud Security
  - Cloud App SecurityVisibility and security for Cloud Apps
  - Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
  - Capture ClientStop advanced threats and rollback the damage caused by malware
  - Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
  - Product Menu Right Image
  - Capture Cloud Platform
    Capture Cloud Platform
    A security ecosystem to harness the power of the cloud
- Button Widgets
  - Products A-Z
    all products A–Z FREE TRIALS
Solutions
- Industries
- Use Cases
- Solutions Widgets
  - Solutions Content Widgets
    Federal
    Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
  - Solutions Image Widgets
Partners
- SonicWall Partners
- Partner Resources
- Partner Widgets
  - Custom HTML : Partners Content WIdgets
    Partner Portal
    Access to deal registration, MDF, sales and marketing tools, training and more
  - Partners Image Widgets
Support
- Support
- Resources
- Support Widget
  - Custom HTML : Support Content WIdgets
    Support Portal
    Find answers to your questions by searching across our knowledgebase, community, technical documentation and video tutorials
  - Support Image Widgets
COMPANY
PROMOTIONS
MANAGED SERVICES
Contact Sales

English English en

Support on SonicWall Products, Services and Solutions

Browse Knowledgebase by Category

Capture Security Center

Management and Reporting

Restrict network access from L2TP VPN Clients

03/26/2020 26 15055

DESCRIPTION:

When L2TP VPN clients successfully connect to the SonicWall L2TP server, they will have unrestricted access to the network behind the SonicWall in either of these two ways:

If the VPN is configured in Split-Tunnel mode, users will have access to the X0 subnet.

If using Route-All mode, they will have access to every subnet under every zone. This is because, unlike WAN GroupVPN GVC and SSL-VPN NetExtender clients, L2TP client access cannot be controlled by VPN Access List. This limitation can be overcome by controlling access via Access Rules. By default, when the SonicWall L2TP server is enabled (on the VPN | L2TP Server page), Access Rules are auto-created from the VPN zone to LAN, WAN and, if applicable, DMZ, allowing any traffic. The Source of such rules will be the auto-created Address Object of L2TP IP Pool with Destination set to Any. In order to override these Allow rules, we must create deny rules with a higher priority.

RESOLUTION:

Navigate to the Firewall | Access Rules | VPN | LAN page.

This page would already have an auto-created rule as under.

This Access Rule cannot be deleted nor its Action, Source or Destination fields edited. To render this rule ineffective, we edit this rule as in the following screenshot.

Create the following deny rule. It is important to first make the changes described above without which SonicWall will not admit creating the following rule (an Allow and a Deny rule with identical parameters is not permitted)

With the above steps, we have ensured that traffic from L2TP clients will not have unimpeded access to the LAN zone. Now we create Allow rule or rules to allow L2TP clients access to selected resources on the LAN.

Similarly, if there are configured interfaces under DMZ, WLAN or custom zones, modify the auto-created rule under VPN | DMZ (or WLAN etc.) and create Allow and Deny rules as above.

Was This Article Helpful?

Yes No

Not Finding Your Answer?

ASK THE COMMUNITY

Stay In Touch

Email Address*
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. You can unsubscribe at any time at Manage Subscriptions.
Country
Company
States
Dnb- ZIP
Dnb- Phone
elqCampaignId
elqTrackId
utm_campaign
utm_medium
utm_source
utm_term
utm_content
gclid
sfdc_campaign_id
DnB - Address
DnB - First Name
DnB - Last Name
DnB - Duns
DnB - Global Ult (HQ) DUNS
DnB - Global Ult (HQ) Company
DnB - Employee Count
DnB - Trade Name
DnB - Currency
DnB - Vanity Title
DnB - Country
DnB - State
DnB - Zip
DnB - City
DnB - Global Employee Count
DnB - SIC Code
DnB - SIC Description
DnB - NAICS Code
DnB - NAICS Description
DnB - Revenue
DnB - Domain
DnB - Business Phone
DnB - Company
DnB - DataSource
DnB - DMACode
DnB - EmployeeRange
DnB - Fortune1000
DnB - Fortune200
DnB - Industry
DnB - Postal Code
DnB - PrimarySIC
DnB - SubIndustry
DnB - PrimaryNAICS
DnB - StockTicker
DnB - Revenue Range
DnB - State or Province
DnB - Website
Email
This field is for validation purposes and should be left unchanged.

Capture Cloud Platform

Federal

Partner Portal

Support Portal

Capture Cloud Platform

Federal

Partner Portal

Support Portal

Restrict network access from L2TP VPN Clients

Was This Article Helpful?

Article Helpful Form

Article Not Helpful Form

Not Finding Your Answer?

Stay In Touch

Restrict network access from L2TP VPN Clients

Categories

Was This Article Helpful?

Article Helpful Form

Article Not Helpful Form

Not Finding Your Answer?

Stay In Touch