We have an external VPN server; somebody within the LAN has connected to it, and I can see the port they connected through (ie. the NAT port the router set up for them).
Is there any way to find the local IP address based on that port alone? Our local router has Tomato USB as firmware.
You can try looking in the NAT and ARP logs and see whats there. There should also be connection logs somewhere (IP-->port). Otherwise wireshark the inbound connections to the VPN server and see who hits what. I have had success with this hunting down upstream and downstream devices from my Layer3 switch, but have not tried with a VPN server.
