Policy Based Routing, can I send VPN over 4G?

There's no way to do a hand-off, Simon, but you should be able to use DynDNS to allow the users to login via the IP on the dongle.

As for outbound traffic, Multipath rules can determine which traffic goes out which connection.  This also would allow fail over if one of the connections went down.

An experienced, knowledgeable UTM installer can probably save you several hours and leave a clean configuration that is easy to modify if your needs change.  Sophos Sales in Australia can suggest a good Sophos Partner near you.

Cheers - Bob

The primary issue is 4G IP addresses are not publicly addressable and so a VPN connection cannot be initiated from the outside world to the appliance over 4G, regardless of DynDNS.

I still feel the PBR has value for us and I certainly won't be configuring this, I don't need that kind of self induced drama in my life.

Cheers.

I just pinged my cell phone operating on 4g LTE, Simon.  Then again, my AT&T cellular IP also responded when I was no longer on LTE, but was using WiFi.  And, I got the same IP when I disabled WiFi on my iPhone again.  I didn't expect that.

I don't understand how a 4G device could communicate on the Internet without a public IP.  Or, are you saying that the IP actually "lives" at the ISP?  Even then,  I would think your UTM could be reached on the IP as determined by the DynDNS client in the UTM.

Cheers - Bob

Hello Bob,

while this link is not 100% technically on the money and should not be relied upon in court, it does illustrate the concept in principle.

https://dyn.com/blog/is-4g-ddns-possible/

However, my mobile provider does allow, in some circumstances, for a price, a static addressable IP on certain LTE devices.

I will post back when I have more details.

Cheers Simon

Thanks, Simon - you taught me something I didn't know!

I see now how that must work.  I'm guessing that their router uses the IMEI or MEID of the cellular device instead of assigning an IP address and tracking that.  In any case, it's clear that you need something special for inbound traffic to be able to be directed to your box.

Cool!

Cheers - Bob