Thanks in advance to anyone who will take time to provide a possible solution. This is my actual situation:

                               ___________________       ________________
INTERNET --------------------- |                 |-------|               |
                               | Main router     |       |  PC 1         |
                               |  |       | IP from DHCP  |
        -----------------------|_________________|       |_______________|
   |                    |
   | Juniper netscreen  |
   | Untrusted interface|                UNTRUSTED ZONE
   |      |
   | Trusted interface  |
   |        |                TRUSTED ZONE
         |            |
   ______|__________  |       _____________________
   |               |  |______|                     |
   | PC 2          |         | Other PCs in the    |
   | |         | 192.168.2.x range   |
   |_______________|         |_____________________|

I need to give Internet access to all the 192.168.2.x devices (.100 included), but to allow requests from the untrusted zone only to the PC with IP I created some rules so that the 192.168.2.x devices (.100 included) now have Internet access, and I can also ping PC1.

The problem is that I cannot ping any 192.168.2.x device from PC1 exception made for the virtual router I tried creating several routes but it didn't work. There surely is something I'm doing wrong.

The final goal is to allow only to be reachable (and ping-able) from the untrusted zone, while still allowing Internet access in the whole trusted zone. I tried reading the Netscreen documentation, but I couldn't find anything useful.

The Juniper Netscreen model is NS-5GT with 5.4.0r3a.0 firmware.

  • did you configure any natting on the netscreen to allow the 192.168.2.x range to access the internet? is it possible to post the configuration of netscreen ?
    – Mr.lock
    Sep 5, 2017 at 10:18

1 Answer 1


Its seems that your NetScreen has its operational mode configured to route and NAT. In that case, you cannot access any computer in the trust zone by setting the destination IP as 192.168.2.X. In fact the 192.168.2.X net is unreachable from the untrusted interface.

In order to fullfill your requirements, you have to configure port forwarding on the NetScreen equipment (please see Juniper Knowledge Base).

Then you have to route the virtual IP to the untrusted interface on your main router, in order to allow PC 1 to reach the virtual IP

  • Thank you for your answer. I saw the link and I followed the guide. As you said, the NetScreen is set to route and NAT. I now configured port forwarding (on http, since PC2 hosts a webserver on port 80) with virtual IP forwarded to trusted IP On the main router, I set to route requests to on Still, this doesn't appear to work for some reasons. I'm now checking the entire configuration, resetting policies and interfaces. If you have other suggestions, I'm ready to listen. Sep 6, 2017 at 13:15
  • Do you test the configuration by using ping command ?
    – vera
    Sep 6, 2017 at 13:20
  • No, I tried connecting (with the web browser) to because I forwarded that port and, if I remember correctly ping works with ICMP and you cannot really forward it. Sep 6, 2017 at 13:47
  • Yes you're right, that's why I asked. I'll look at your comment more precisely tonight
    – vera
    Sep 6, 2017 at 13:53
  • Thank you. I want to underline that the webserver on PC2 normally works when you are inside the trusted network. There must be something I'm still doing wrong. I'm now repeating the forwarding and routing on a different destination to see if something changes. Sep 6, 2017 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.