forbid Access from / for a specific Network / Subnet

Question

Hi Guys, 
 these Time I've a really strange Situation and hope for your Help / a good Idea. 
 Situation: 
 I've a Subnet which should only be able to connect using VPN. So I created the VPN by Remote Access SSL and disabled the Firewall Rule (DNS, Websurfing). I tried to connect to the Internet and to my Surprise it still works. Then I tried to disable this Network completely and disabled (for testing) the Masquerading Rule, but it still works (Internet Access). And now I tried to create an Network Rule which forbids all Traffic from this Subnet and maybe you guess that it still works -> confused. 
 Maybe someone has an Idea of what goes wrong here? 
 No Masquerading Rule, nothing that allows the Traffic through the Firewall and although a Rule to block all Network in the Firewall -> but still Internet-Access. I'm confused

DouglasFoster · Answer

On your VPN Profile, you configure an Allowed Networks list. Traffic for those destinations go through the VPN tunnel, and everything else is handled by the PC's network connection. I think this is the reason for your symptoms. It is also probably all that needs to be done for your scenario. This is called split-tunnel VPN. 
 An alternative is for the VPN Profile to allow all networks, to create a full-tunnel VPN . This forces all network traffic to flow to the UTM, which means that you need to have configuration rules to block whatever is needed. UTM has a unique architecture: traffic which goes through a proxy will bypass the firewall rules. That is why this configuration is more complicated. 
 To illustrate: 
 Assume you SSL VPN traffic arrives on 10.10.10./24nd is only supposed to have access to 192.168.10.0/24, but your entire network uses many subnets within 192.168.0.0/16. VPN access to Internet should also be blocked. 
 Firewall Rules 
 
 ALLOW traffic from 10.10.10.0/24 to 192.168.10.0/24 port ANY. 
 BLOCK traffic from 10.10.10.0/24 to ANY port ANY. 
 
 Web Proxy, FTP Proxy, POP3 proxy, etc 
 
 Ensure that 10.10.10.0/24 is not on any Filter Profile allow network range, OR 
 Create a Filter Profile for 10.10.10.0/24 which is linked to a policy and a Filter Action that blocks everything, then give it precedence over any filter profile that includes 10.10.10.0/24 in a larger network range. 
 
 WAF 
 
 Use Access Control on Site Path Routing to prevent access from the VPN subnet