I have a remote computer behind a VPN (which I have no control of). The IT team of the remote factory wanted me to install Palo Alto Networks' Global Protect program to access the VPN, which is working fine.

This program creates a new network interface with IP Also when I look at the route table of my computer I can see a line with destination should use the interface So, as I understand it routes the traffic through this network adapter whenever I want to reach the remote computer, which has an IP of

This remote computer also has access to a local private network (which I have control) through another network interface on the remote computer which has the IP and there are 4 other devices on this network.

I was searching a way to directly access these 4 devices from my computer when I had this idea: What if I add an entry to the route table of my computer as as destination and as a gateway. I think I also need to add another rule to the remote computer to route between two network interfaces on it, but I cannot figure out what it is.

So the questions are:

  1. Is it even possible to access to these remote devices in this setting?
  2. If so, can my idea work with correct settings and what are these settings?
  3. Can you suggest another way for accessing these devices?

Edit. Trace route of the remote computer. enter image description here

  • Can you add the output of traceroute from your computer to – Ankit Badani Mar 2 at 7:50
  • @AnkitBadani I have added it. Also I misremembered the numbers and fixed it in the question. – obareey Mar 2 at 8:01
  • First, that is not a traceroute, that is a routing table. Next, please, never use an image for text. Simply copy the text and paste it into the question and use the Preformatted-text option ({}). Last. host/server configurations are off-topic here, and you can ask about those on Server Fault for a business network. – Ron Maupin Mar 2 at 15:04

You cannot configure a gateway that you cannot talk to locally (on-link).

As it is, you've got two gateways:

  1. your default gateway pointing to WAN
  2. the tunnel gateway pointing through VPN

What you were trying to accomplish is called source routing which is long obsolete and only very rarely supported nowadays.

If you want to access more networks via VPN you need to use the VPN gateway - the same as for Routing beyond the tunnel cannot be controlled by you and must be done by the VPN gateway or beyond.

Whether simply setting that gateway route does or doesn't works depends on the VPN settings on the far end. Contact the admin for further information.

| improve this answer | |

The way GlobalProtect works is while handing out SSL VPN IP addresses to client, it acts as the default gateway for the routes configured with GlobalProtect Gateway. Now, if you are reaching, packets will be sent to Palo Alto GlobalProtect Gateway and then to the inside interface after gong through all the security policies and hitting an allow policy.

In your case, while sending traffic to and from, according the route, remote PC will send everything to First do a source ping from to to check whether that internal routing has been enabled. If it has been enabled, you need to ask the firewall administrator to add/allow that network for GlobalProtect VPN. If you are not able to source ping, you will not be able to reach those remote computer secondary NIC and computers in subnet.

| improve this answer | |
  • I tried source ping to but it didn't work. – obareey Mar 2 at 14:15
  • It is possible that Palo Alto or does not have a route back to – Ankit Badani Mar 2 at 14:28
  • This is the point. They are two separate networks. doesn't even know 172.16 exists. The idea was that I can add a route rule to make that happen. – obareey Mar 2 at 14:31
  • You have answered your own question it seems. I am explaining why it won't work. – Ankit Badani Mar 2 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.