I need a decision support for the configuration of incoming VPN connections.

The setup consists of 2 cascaded routers. Router A (Zywall USG210) acts as front firewall and router B (Lancom EF1781) as back firewall. At the moment, router A is accepting VPN connections while router B forwards only RDP traffic from the VPN clients to selected computers in the intranet. In the near future direct access to some services (Solidworks PDM, Windows fileserver, exchange) in the intranet is needed.

Is it preferable that router B handles the incoming VPN connections, or should this router allow all VPN traffic coming from router A?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Sep 19, 2017 at 21:27

1 Answer 1


You don't state the reasons for two firewalls, but I'd always use the frontmost router for VPN and forward the VPN client traffic from there - makes it easier to find problems if they should come up. Using a backend router to terminate the VPN tunnel requires you to forward all IPsec traffic which can be troublesome, especially when using NAT.

  • I wanted to protect the inner router and be flexible in the future (the company is in development and not fully structured yet)
    – Tom
    Jul 22, 2017 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.