I have the following setup;

Router A
Interface 1:

Route added on Router A to access via

Router B
Interface 1: VPN Interface:

VPN Client Connects to Router B gets IP:

I am able to ping from Router B (VPN server) and I can ping from Router A. But I can't access from Router A. I can see traffic goes to the interface of Router B but won't reach the client. I don't want to use NAT here, but want to locally route public subnet.

Looks like I am missing something or NAT is the only way here?

The idea behind is that I want to be able to BGP advertise a Public subnet via VPN client going through Router A. In other words, want to use the BGP subnet from router A on a physically different location. Now I can have privet BGP session with the remote network but the VPN client network does not have a Public IP address. Any ideas?

  • What is your router brand and model? What is your current configuration? – Cown Sep 9 at 10:11
  • I got brocade CER-2024C which runs BGP as well. There is no VPN feature on this router so I can't get an direct communication from the VPN client to this router. Since my VPN client is on a NAT, I setup Wireguard tunnel on a Linux box (Router B) in this case and let the VPN client and Linux router talk. – NBhatti Sep 9 at 13:21
  • According to Extreme, the 2000 series does support VPN. – Zac67 Sep 9 at 15:20

Most likely your VPN client just gets the single route to run over VPN, pointing into the tunnel. You need to configure both VPN client and server to route through the tunnel as well.

Edit: On the client, you need to be able to traceroute into the tunnel and see this packet arrive at the VPN gateway.

Without the route, the client sends any reply or other traffic destined for to his default gateway which, in combination with SNAT, breaks the routing.

BGP only propagates routes between routers, not to a normal end node.

Edit2: On second reading, you're using the very same subnet between the routers and towards the VPN client - accordingly, router A expects the IP address to be within its own local reach, not routing it across router B. So, router B either needs to do proxy ARP for or - preferably - you need to use distinct subnets between the routers and between the VPN router and its clients.

  • I agree without the route VPN client will send the replies back to the default gateway, but even in this case shouldn't it see the traffic (ping) on the VPN interface, atleast? – NBhatti Sep 9 at 13:18
  • Allow both subnets on VPN config did not do the trick either. and are both allowed on the client. When I ping from the router A to the VPN client, I can see traffic on Router B interface which is connected to router A. Perhaps I need some interface routing here? 13:30:33.045401 74:8e:f8:63:aa:41 > 00:50:56:bd:1b:bd, ethertype IPv4 (0x0800), length 60: 23.128.xx.33 > ICMP echo request, id 43787, seq 1, length 24 But from this interface which is ens160, it's not going to wg0 interface which is then connected (VPN) to the client. – NBhatti Sep 9 at 13:31
  • Without being able to see the vPN connection on both sides, we're just guessing at answers. – Ron Trunk Sep 9 at 15:10
  • @NBhatti With a Linux gateway, you need to make sure that its iptables allow the communication you want - details are off-topic here, however. – Zac67 Sep 9 at 15:22

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.