0

I have the following setup:

  • I have setup a Layer 3 Switch with multiple VLANs
  • Multiple devices are connected to it on different VLANs via untagged access ports
  • There is also a router connected to the switch which provides internet access (not part of a VLAN)
  • A special access device is also connected to the switch over a trunk port. This device has multiple tagged (virtual) interfaces allowing it to communicate to all devices on all different VLANs. It uses Windows 10 as the operating system.
  • A remote device is connected via VPN tunnel to the access device. It uses TeamViewer VPN.

Quick drawing of the setup: enter image description here

Now the problem is on the remote device I can't ping any of the other devices (Device B, Device C). As per my understanding of VPNs, I should now be able to access those devices. I can ping Device B and Device C if I directly log in to Device B, but not on the Remote Device, however I can establish a TCP connection to tools running on Device A, so the VPN works.

I checked the routing table on Device A, but it seemed OK to me. I also enabled the "Route and Remote Access" service on Windows 10, but still no success.

Does anybody have some tipps or ideas what I could have missed? I am no network expert so I would greatly appreciate your help. :)

1
  • It's the route table on all the other devices you need to check. If the remote device's IP is routed by via Device A, connections won't work.
    – Ricky
    Mar 11 at 11:14
1

VLANs are only useful within a shared L2 infrastructure. VPN is (usually) L3, so you route into the VLANs from the VPN tunnel endpoint (and vice versa, for simplicity I'm referring to the in direction only). The destination address is the L3 subnet, located in a VLAN.

For security, you filter by combination of source address and destination subnet (or address) between the tunnel and the inter-VLAN router. Of course, that implies that you trust the far tunnel endpoint, ie. you can be sure that the source IP has not been spoofed. If that isn't the case you either need to use other means of user identification or multiple tunnels for the various trust zones.

Routing needs to be consistent, so that all routers on each tunnel side know where to route all subnets. Set up static routes or use a routing protocol like OSPF. In your diagram, the L3 switch and the right-hand router need to know the route to "Remote Device". In turn, Remote Device needs to have routes for 192.168.1.0/24, 192.168.10.0/24 and 192.168.20.0/24 pointing into the tunnel. Additionally, the tunnel needs to be able to transport these destination addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.