Sentinel LM problem

[jclambert1]

updated network diagram atatched

[jclambert1]

Originally Posted by dbunyard

I'm sorry if I'm seeming ignorant here but I want to make sure I understand your setup. So the problem is the flow of traffic like this, right:
|Remote site|<==>|Internet|<==>|Local Router|<==>|Untangle|<==>|LAN|
The remote sites cannot access a server in the LAN even though a VPN is established to the local router? Sorry for the questions, I just want to make sure I understand.

BAsically yes. All traffic is flowing properly (SMB, internal web pages, printing, jabber, etc) aside from the LM on UDP shown above.

[dbunyard]

So how about a bypass rule from 10.0.1.x (and 3.x) to/from your LAN IP range?

[jclambert1]

Originally Posted by dbunyard

So how about a bypass rule from 10.0.1.x (and 3.x) to/from your LAN IP range?

Bypass rule? Wouldn't that be something for firewall? I do not have that module installed. Or is this placed elsewhere in the system?

[dwasserman]

The firewall app its only a ACL subsystem, not a firewall.
In the up left corner of the rack, default rack button, show session option, you can show and debug what happen with this traffic flow.

[jclambert1]

I see. I will look it over in the AM. Thanks!

[johnsonx42]

the bypass rules have nothing to do with the firewall module. they're under networking->advanced->bypass rules. these rules tell the networking code (the linux bits) to just route the packet on without passing it through the untangle vm (or in other words, to bypass the application rack). even though nothing in the uvm is blocking or really even looking at that traffic, the mere act of passing through it can foul up certain types of communication.

you can just bypass the particular udp port.

[jclambert1]

Originally Posted by johnsonx42

the bypass rules have nothing to do with the firewall module. they're under networking->advanced->bypass rules. these rules tell the networking code (the linux bits) to just route the packet on without passing it through the untangle vm (or in other words, to bypass the application rack). even though nothing in the uvm is blocking or really even looking at that traffic, the mere act of passing through it can foul up certain types of communication.

you can just bypass the particular udp port.

Just bypassing the port in question worked just fine.

[dmorris]

I suspect your netmask is too big. (likely /8 or /16 and needs to be /24)
If you want it to be bigger than /24 you'll need to add routes for 10.0.1.x and 10.0.3.x so Untangle does not think they are local.

Bypass will also work, but you'll need to do this for all services remote clients want to reach if you have it setup like that.