Ran into this one again recently and figured I'd write it up since it trips people up constantly.
Setup: office has a site-to-site VPN to a vendor's network for some internal app. Works fine for anyone sitting in the office. But the second someone connects remotely over NetExtender (SonicWall's SSL VPN client), the same app just… doesn't load. No error, just times out.
The instinct is to blame the site-to-site tunnel, but 9 times out of 10 that tunnel is completely healthy. The actual problem is that the SSL VPN client traffic has to hop through two separate VPNs to get there, and SonicWall treats that SSL VPN client as its own separate network — not as if it's sitting inside the office LAN. So every layer that "just works" for office users has to be explicitly configured for the remote ones too.
The things that usually turn out to be missing, roughly in the order I check them:
- NetExtender handing out the user's home router as DNS instead of the internal DNS server, so the internal hostname never resolves in the first place
- The vendor's subnet not being included in the routes pushed to the SSL VPN client, so even if DNS resolves, Windows just sends the traffic out the regular internet connection instead of the tunnel
- No access rule allowing SSLVPN zone → VPN zone (there's usually already one for SSLVPN → LAN, but that doesn't cover traffic headed to a site-to-site tunnel)
- The SSL VPN client's IP pool not being included in the site-to-site VPN's local network / proxy ID definition, so even correctly-routed traffic gets silently dropped because the tunnel doesn't recognize where it's coming from
That last one is the sneaky one — everything can look right on your end and it'll still fail if the vendor's firewall doesn't know your SSL VPN subnet exists.
I put together the full walkthrough with the exact menus/commands to check each layer (ipconfig, nslookup, tracert, etc.) here if anyone wants the step-by-step: https://www.firewallflow.com/double-hop-vpn-access-on-sonicwall/
Curious if others have hit this with different firewall vendors too — feels like a "learned it the hard way" kind of problem.
Source: r/FirewallFlow · by /u/samsh92