VPN Site to site, The port forwarding only works at the main office.

The default gateway of the PC at 192.168.1.75 is 192.168.1.1 .. and that's the BSR222 IP address.

The PC is connected at site B (where the Port forward didn't work)
IP : 192.168.1.75/24
DG : 192.168.1.1
DNS : 192.168.1.1

I'm able to manage the two BSR222 (192.168.1.1 and 3.1).
I'm able to ping every computer in the site to site lan.
I'm able to ping www.google.com

But when I do port forwarding on any PC at 192.168.1.1/24 it doesn't work.
All port forwarding at 192.168.3.1/24 works.
When I shut down the site to site vpn, all the port forwarding works at 192.168.1.1

I saw a warning note in the documentation once about the 222 using 192.168.1.1 internally by default or something like that. Is it possible that this is the case they are warning about? I don't remember the details of it. Is site B small enough to try using a different subnet to avoid that possible issue?

Well, yes I can try this.

Is it the 192.168.0.0 network or only the 1.1 ?

Can I set it to 192.168.2.1/24 ?

And just to remember you, as soon as I shutdown the Tunnel with the other site, all the port forwarding are working great...

Thanks for your fast answer

Frank

Hi Frank,

I think it was only 192.168.1.1 so using the 192.168.2.0 subnet should avoid that. The only other thing I can think of is if the firewall rules blocking but they are not supposed to apply to the ipsec vpn tunnels. Just the tunnel policy. Is there a way to open up the policy to allow everything for a test?

Hey Rick !

Yes I can open all the ports for a moment but in my firewall log this is what I see :

05/11/2008 08:01:50      Firewall rule match: TCP (W to L, rule:3)      Mypublicip:port      192.168.1.75:6320      ACCESS FORWARD

.. this is it

That log entry looks like it is for the TCP 6320 port traffic and the firewall is forwarding it from WAN to LAN. That's why I was wondering about the Default gateway. I was thinking maybe the forwarding is getting to the PC but it didn't have a path back. Sounds like that isn't the case though.

Have you tried allowing netbios over TCP LAN to WAN. Just a thought.

Frank,

I am still thinking about this issue. I think you need to have private DNS set up to allow the 192.168.1.75 PC
 to successfully reply to the requests forwarded to it back through the tunnel.

Hi Rick,

I tried the Netbios over TCP and it crashes my vpn tunnel.

I don't understand the purpose of setting up a private DNS server..

Thank you

Frank

If you don't use the private DNS server set up then DNS requests from site B will go to the ISP DNS server. Your private address names won't resolve there.

Hi Rick,

I don't see the purpose of setting up a DNS since all traffic is unfortunately forwarded to the main office.

Exemple : I'm at site B (192.168.1.1), I open www.whatismyip.org and it gives me the Public IP address of my main office (at 192.168.3.1) ...

Even if I make a trace route with public IP (no DNS  just a known public IP) it passes through the Site to site tunnel and exit at the main office.

Tracert 60.60.60.60 -->Branch office (192.168.1.1) --> tunnel --> Main office (192.168.3.1) --> WAN

It should be :

tracert 60.60.60.60 --> Branch office (192.168.1.1) --> WAN

I also tried to implement RIP .. no luck.

If you know a way to modify the default route in the BSR 222 I think this could be great.


Thanks for your help, it's highly appreciated.

I assumed that your applications were using local DNS names between the sites and that the site B side was passing its requests to the public DNS server at the ISP and not getting them to your local DNS server at site A throguh the tunnel.  
The static default WAN route can't be modified or deleted.

Ok, let me know if you have other solutions.

Thanks

Do you maybe need to add a static route back to Site A pointing to the tunnel?