How to allow L2TP VPN when WAN interface doesn't exist in default WAN trunk?

Zyxel_James

QUESTION
In this scenario, the WAN interface for L2TP connection does not exist in the default WAN trunk, how to allow L2TP VPN such a WAN interface that is not in the default WAN trunk?

ANSWER
You can add policy routes to resolve this situation because policy route priority is higher than the default WAN trunk.

Policy route:
(1) Incoming: L2TP VPN, Source: L2TP VPN subnet, Next-Hop: Auto, SNAT: Outgoing-interface.

(2) Incoming: ZyWALL, Source: WAN interface, Source Port: UDP1701, Next-Hop: L2TP VPN tunnel, SNAT: none.

(3) Incoming: ZyWALL, Source: WAN interface, Next-Hop: WAN interface, SNAT: none

Please note thatSince UDP1701 port belongs to ESP packets, it must be routed into VPN tunnel.