0

I have 4 networks:

A: 10.10.1.0/24  --\
B: 10.10.2.0/24  ---\  Juniper SSG-350M
C: 10.10.3.0/24  ---/ 
D: 10.10.4.0/24  --/

I have a FreeBSD host in network D with an OpenVPN server working in tunnel mode with this segment: 172.16.13.0/24

Route rule applied after clients connect:

route add -net 10.10.0.0 172.16.13.1

Clients connected to the OpenVPN can ping/access hosts from all other networks:

172.16.13.X --> 172.16.13.1 (openvpn gw) --> 10.10.X.1 (A,B,C.D gw) --> 10.10.X.X

But for some reason can not ping / telnet the gateways (10.10.X.1) from a connected client:

172.16.13.X --> 172.16.13.1(openvpn gw) --> 10.10.X.1

If I enable NAT on the OpenVPN host, I do can ping/telnet the gateways, and continue to have access to the other hosts, therefore I would like to know, why is that I cannot ping the gateways when not using NAT?

Currently OpenVPN is working fine only using routes not need to do NAT, but just would like to know why ping/telnet not working on the gateways and does work for the host.

Improve this question
2
  • @MikePennington Did he really tag JunOS? I thought SSGs ran on ScreenOS, even though that still has nothing to do with the question, which is more dependent on the OpenVPN implementation.
    – Donbhupi
    Mar 6, 2015 at 14:13
  • ...tagging is really important. If it's tagged wrong, the NE members who you need help from, may never notice it. That said, please leave the sense of entitlement at the door. Not sure what this is getting close-off-topic votes though. I'm leaving it open.
    – Craig Constantine
    Mar 17, 2015 at 15:00

1 Answer 1

Reset to default
0

Obvious answer: (a) no route, (b) ACL

The router (actually "firewall" -- Secure Services Gateway) has no route for 172.16.13.0/24? But that should also prevent access through the router to the other LANs. Which leaves only an explicit or built-in ACL blocking access to the router.

(Check the config, logs, etc.)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.