I have a Meraki MX84 with two VLANs, (main subnet), and I have an EdgeRouter 12P connected to the MX with static WAN IP The issue is: when I VPN into the MX from home, I can access the ER GUI at, as well as several IPs behind the ER that are NAT'd from the ER's WAN interface. When I am on site and connected to the main subnet, however, I am not able to access the ER's GUI or NAT'd IPs behind it. Why am I able to access the ER from the VPN workstation and not the LAN? Hopefully the attached diagram will help explain the situation. I think I might need to configure two virtual adapters on the LAN workstation (with only one of those having a gateway to retain reliable internet access), but haven't tried this. enter image description here

  • 2
    Why are you NATing inside your own private address space? Likely, that's the problem. If not you need to add the basic configurations including routing tables, NAT rules and firewall rules for the routers involved to your question. We can't use a crystal ball.
    – Zac67
    Nov 14 '19 at 11:06

"LAN workstation" is in the subnet - the same subnet you're using for "BAY x LAN". That is a very bad design.

Unless you are using destination NAT and source NAT between those locations, no communication is possible. Likely, you're using destination NAT from LAN workstation to reach "Device N", but without source NAT "Device N" tries to send the reply locally, not through the gateway. No go.

The only sane solution is to renumber the network to get rid of NAT entirely (except for WAN/public IP space). Remember that NAT is a kludge is needs to be avoided wherever possible.

At the very least, you need to change the workstation LAN subnet address to something else, so it doesn't seem to be local to the Device N LANs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.