Code: Select all
reducted
Masquare required when pinging same vlan over VPN
I setup l2tp vpn. it works as expected. When I access other vlans it also works. However, if I try to access a device in the same vlan it doesn't work. Unless I define masqarade. What is the reason for this?
Last edited by ahmet82 on Sun Nov 13, 2022 5:54 pm, edited 1 time in total.
Re: Masquare required when pinging same vlan over VPN [SOLVED]
User error, as usual. 
You have same pool for VLAN and VPN. So you're saying that whole 10.97.20.0/24 is on "97 TRUSTED VLAN" interface, but it's not true, because some addresses are elsewhere. Device connected to VLAN expects all these addresses to be directly reachable, because they are in same subnet. But they are not. If you want to keep same pool, then it's either your srcnat, or you can enable proxy ARP on "97 TRUSTED VLAN" interface (arp=proxy-arp).
Btw, if this is your whole config, then you have no firewall at all and everything is wide open, that's not ideal.
You have same pool for VLAN and VPN. So you're saying that whole 10.97.20.0/24 is on "97 TRUSTED VLAN" interface, but it's not true, because some addresses are elsewhere. Device connected to VLAN expects all these addresses to be directly reachable, because they are in same subnet. But they are not. If you want to keep same pool, then it's either your srcnat, or you can enable proxy ARP on "97 TRUSTED VLAN" interface (arp=proxy-arp).
Btw, if this is your whole config, then you have no firewall at all and everything is wide open, that's not ideal.
Re: Masquare required when pinging same vlan over VPN
Got it thank you. I am just setting it up. I will put the firewall rules today
Who is online
Users browsing this forum: No registered users and 19 guests