[northlandboy]

There's your problem.

When you add a new site with SecureClient, it connects to the IP address you give it, and uses that to download topology. That's why you can successfully add the site either internally or externally.

Once it's downloaded topology, it uses the information in the users.C file to connect. It will use whatever you have put as the cluster object IP in SmartDashboard to try and establish a VPN.

Since you've set up that cluster object with the internal IP, that's why it works when you connect internally, and not externally.

Do you want to be able to establish a tunnel both from your LAN and the Internet? If you do, you'll need to look into NGX link selection, assuming you're using NGX.

If you only want to establish a tunnel from the Internet, then you'll need to change the cluster object IP to use the external cluster address.