0

I have 4 networks:

A: 10.10.1.0/24  --\
B: 10.10.2.0/24  ---\  Juniper SSG-350M
C: 10.10.3.0/24  ---/ 
D: 10.10.4.0/24  --/

I have a FreeBSD host in network D with an OpenVPN server working in tunnel mode with this segment: 172.16.13.0/24

Route rule applied after clients connect:

route add -net 10.10.0.0 172.16.13.1

Clients connected to the OpenVPN can ping/access hosts from all other networks:

172.16.13.X --> 172.16.13.1 (openvpn gw) --> 10.10.X.1 (A,B,C.D gw) --> 10.10.X.X

But for some reason can not ping / telnet the gateways (10.10.X.1) from a connected client:

172.16.13.X --> 172.16.13.1(openvpn gw) --> 10.10.X.1

If I enable NAT on the OpenVPN host, I do can ping/telnet the gateways, and continue to have access to the other hosts, therefore I would like to know, why is that I cannot ping the gateways when not using NAT?

Currently OpenVPN is working fine only using routes not need to do NAT, but just would like to know why ping/telnet not working on the gateways and does work for the host.

  • @MikePennington Did he really tag JunOS? I thought SSGs ran on ScreenOS, even though that still has nothing to do with the question, which is more dependent on the OpenVPN implementation. – Donbhupi Mar 6 '15 at 14:13
  • ...tagging is really important. If it's tagged wrong, the NE members who you need help from, may never notice it. That said, please leave the sense of entitlement at the door. Not sure what this is getting close-off-topic votes though. I'm leaving it open. – Craig Constantine Mar 17 '15 at 15:00
0

Obvious answer: (a) no route, (b) ACL

The router (actually "firewall" -- Secure Services Gateway) has no route for 172.16.13.0/24? But that should also prevent access through the router to the other LANs. Which leaves only an explicit or built-in ACL blocking access to the router.

(Check the config, logs, etc.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.