Routing between FWG over VPN?

Follow

William Smith

• June 02, 2023 20:06

I have Gold-A with LAN: 192.168.101.*

It's got a site-to-site (Open)VPN tunnel to Gold-B with LAN: 192.168.0.*

Everything works fine between the two, so that's great.

Gold-B gets it's WAN connection through an ISP network, 192.168.3.*

How do I allow devices on Gold-A (192.168.101.*) to access devices on the ISP LAN (192.168.3.*) without allowing connections in the other direction?

Thanks!

 

0

• 

  Arijit Panda

  • June 02, 2023 23:40

  You need a site to client connection not a site to site. Site to site is a bidirectional setup while site to client is unidirectional. This will solve the scenario you are mentioning here.

  0

  Comment actions Permalink
• 

  William Smith

  • June 03, 2023 07:17

  But I like the site-to-site tunnel between 192.168.101.* and 192.168.0.*, I can’t just add a route for access to 192.168.3.*?

  0

  Comment actions Permalink
• 

  Andy

  • June 03, 2023 19:26

  You could, and maybe add a rule to block 192.168.3.* ifrom the other networks

  0

  Comment actions Permalink
• 

  William Smith

  • June 03, 2023 21:06

  I want (all) the other networks to be able to get to 192.168.3.*, but I don't want 192.168.3.* to get to any other networks.  It can't today because it's on the WAN port of the FWG-B above.

  0

  Comment actions Permalink
• 

  William Smith

  • June 06, 2023 13:47

  Bump?

   

  0

  Comment actions Permalink
• 

  Arijit Panda

  • June 06, 2023 14:08

  First time when i responded, I made a mistake with what you were asking but i made this pic to clarify the ask. To me the ISP is a higher order network than the firewalla as it is connected to the WAN port, network discovery works in the downward direction not on the upward direction. So the requested scenario is impossible to achieve in the firewalla environment. Pic attached for reference. Red and Green arrow is the scenario that you are requesting to be achieve.

  

  0

  Comment actions Permalink
• 

  William Smith

  • June 06, 2023 14:16

  Correct, everything works fine, and I can get to devices on 192.168.3.* from 192.168.0.*

  I'd like to be able to get to devices on 192.168.3.* from 192.168.101.*

   

  0

  Comment actions Permalink

Please sign in to leave a comment.