Wake on Lan over SSL VPN - TZ470

Answers

• BWC Cybersecurity Overlord ✭✭✭

  February 23

  @dbdan22 WoL does not work out of the box over Layer3 and need some requirements.

  First of all, WoL using the MAC address will not work obviously so we need a WoL client supporting sending the magic packet to an IP address, Nirsoft seems to do that. This requires a static IP for the client.

  Second your VPN access settings for SSL VPN must allow access to the IP address you wanna wake up.

  Third, which is probably your missing link, the Firewall does not know the MAC address of the client, because ARP requests do not get answered when the client is offline. The only way I'am aware of to solve this, is to create a static ARP entry (the MAC address of the client) to enable the Firewall to route the magic packet properly to it's destination.

  Hopefully this helps a little, if not you might check with Packet Monitor if there is anything dropped on it's way.

  --Michael@BWC

  0
• dbdan22 Newbie ✭

  February 23

  Hi,

  Thank you for your reply.

  I'm confused.

  "WoL using the MAC address will not work" - but the MAC address is required, you cannot send the magic packet without it. The magic packet contains 16 repetitions of the target computer's MAC address.

  "This requires a static IP for the client" - Why? It's a broadcast. "The magic packet is broadcast on the data link layer to all attached devices on a given network, using the network broadcast address; the IP address (which relates to the internet layer) is not used." (wikipedia)

  "Second your VPN access settings for SSL VPN must allow access to the IP address you wanna wake up" - isn't that what IP Helper does?

  "the Firewall does not know the MAC address of the client, because ARP requests do not get answered when the client is offline." - again, it's a broadcast, it doesn't have to know the MAC address of the client. It gets broadcast to all devices on the network, and the target computer, being in a low power state, gets the packet and sees 16 repetitions of its MAC address and wakes up.

  If someone with a working WOL setup could share some tips to get WOL through VPN I'd greatly appreciate it.

  Thanks.

  0
• BWC Cybersecurity Overlord ✭✭✭

  February 23 edited February 23

  @dbdan22 long story short, sending packets to a MAC address does not work over Layer 3 (everything routed, such as VPN). Broadcast does not apply here, because you cannot send a broadcast packet into the SSLVPN which ends up in your LAN.

  I implemented something similar with SonicWall SMA, which comes with a WoL client that supports WoL via IP address, IMHO Nirsoft does this as well.

  WakeMeOnLan also allows you to turn on a computer from command-line, by specifying the computer name, IP address, or the MAC address of the remote network card.

  Update:
  You could try the following approach and see if the Broadcast gets transferred, 
  but IMHO it's not as easy as my approach.
  

  https://www.sonicwall.com/support/knowledge-base/how-can-i-allow-netbios-traffic-via-sslvpn/170505417512291/

  --Michael@BWC

  1
• dbdan22 Newbie ✭

  February 23

  Possible complication:

  Both the PC running Netextender, and the target network, have the same IP address range: 192.168.1.0/24

  Even if I give the target PC a static IP, will I be able to send the packet?

  I've noticed that when I fire up Netextender and connect to the network, I can Remote Desktop to a PC by its FQDN but not by its IP address. What's going on behind the scenes here?

  0