NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
VPN client access to DMZ systems on Netgear ProSafe SRX5308
Greetings, I have Netgear ProSafe SRX5308 with the latest firmware for present moment - 4.3.3-5. I have WAN 1 configured (lets say public IP 7.7.7.7) - it works fine, does not matter for curr...
Think about the following ...
1) The VPN client setup tells the client where to send traffic intended for the 172.16 network, does the client know what to do with traffic intended for the 192.168.32 network? Will it send it to the default gateway or will it send it through the VPN tunnel? Try using traceroute and see if the 192.168.32 traffic even gets to the 172.16 network.
2) What makes you think there are no extra routing rules "on client to access LAN from VPN" - presumably a software VPN client is being used here - if you do not configure the routes on the client (see #1) the client will route ALL "non-local" traffic to the default gateway, which will then send it to it's default gateway, which, is most likely the ISP router, and which most likely has been configured to discard all private non routeable traffic. If a router~router VPN is in use, there will be no extra routing rules on the client but there most certainly will be on BOTH routers involved, if not the routers will route all "non-local" traffic as mentioned above, and it will never reach it's intended destination.
3) The only time a router can/will route between networks without being specifically configured to do so is between what are known as "directly connected" networks, and when VPNs are involved, at least one of the networks involved is going to be be a remote network - and just so this last is clear - it is possible to have routers communicate between themselves and dynamically change routes through the use of dynamic routing protocols, however these dynamic routing protocols require specific configuration, even if they do not require the routes to be specified.
Approaching the issue from a different angle...
Why are these servers in the DMZ in the first place? In most cases servers placed in a DMZ are put there to allow "controlled" remote access, either from the public internet, or from a private intranet - the reason for having a DMZ is to separate these servers from the main network, so as to limit exposure to the main network should one of the servers be compromised.
If you have no intent to provide this access, then there is no reason to have a DMZ, and once this access has been permitted, why would you then need separate access via a VPN? Why would you not use the primary access method already established?
"Why are these servers in the DMZ in the first place? " - those servers are Apache HTTPd servers, so they will be "NAT"ed to public network when configuration done, but only HTTPs protocal will be exposed. But I need ssh access to hose servers to update contnent and configuration. Sure putting those in DMZ and restrict access I protect my internal LAN from get used in case HTTP server will be hacked, so attacked can not get deeper in my LAN.
"why would you then need separate access via a VPN? " - I explaned that from my first post, from time to time I have to work from the road, so I should be able to access HTTP servers in DMZ over ssh at any time, when I am in the office or I am at home.
Routing answers. I do not think that trafic from VPN client to DMZ should go over LAN segment since Netgear router has interface in VPN and DMZ, I mentioned that _rules_ I am created for LAN-DMZ probably should be applyed to VPN-DMZ traffic too, since I see no separate rules place for VPN-DMZ.
Below my routing table on client after I connected to Netgear VPN using L2TP and got 172.17.172.2 address (L2TP network is 172.16.17.0/24). As you can see this VPN address I got from Netgear router 172.17.172.2 is default gateway. I can reach 172.16.0.0/16 LAN servers wihout any extra routing and cannot 172.17.172.0/24 DMZ servers. I would like to be able to reach DMZ servers same way as LAN servers from VPN. Here 192.168.1.x my home network (192.168.1.73 my private IP in home network). 91.XXX.XXX.XXX is public IP of Netgear router.
C:\TEMP>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 fa 89 7c ...... AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport
0x10004 ...00 ff 98 8c 2b 82 ...... Juniper Network Connect Virtual Adapter - Shrew Soft Miniport Filter
0x20005 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.17.172.2 172.17.172.2 1
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.73 11
91.XXX.XXX.XXX 255.255.255.255 192.168.1.1 192.168.1.73 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.17.172.2 255.255.255.255 127.0.0.1 127.0.0.1 50
172.17.255.255 255.255.255.255 172.17.172.2 172.17.172.2 50
192.168.1.0 255.255.255.0 192.168.1.73 192.168.1.73 10
192.168.1.73 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.1.255 255.255.255.255 192.168.1.73 192.168.1.73 10
224.0.0.0 240.0.0.0 192.168.1.73 192.168.1.73 10
224.0.0.0 240.0.0.0 172.17.172.2 172.17.172.2 1
255.255.255.255 255.255.255.255 172.17.172.2 172.17.172.2 1
255.255.255.255 255.255.255.255 192.168.1.73 192.168.1.73 1
255.255.255.255 255.255.255.255 192.168.1.73 10004 1
Default Gateway: 172.17.172.2
===========================================================================
Persistent Routes:
NoneWBR, Andre
There's something odd about that routing table - for starters it has multiple default routes - and only one of them can actually work.
What VPN client are you using, and is it configured for "full tunnelling"?
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
