[SOLVED] - USG20-VPN BEHIND A FRITZBOX! 7590

Max_Tor
Max_Tor Posts: 8
First Comment Friend Collector
edited April 2021 in Security
Hello!
I've a FritzBox 7590 as a modem router with direct access to internet. The network is 192.168.188.0.
I've created a static route to 192.168.99.0 with gateway 192.168.188.200.
I've a Zyxel USG20-VPN connected to a LAN port of a Frizbox mesh repeater 2100, with static IP 192.168.188.200.
The network configured on the USG is 192.168.99.0, and there are 3 PC that actually can navigate to the internet network.

Now, the problems are:
  • 192.168.188.200 (USG20 WAN) is not found (no ping, and no HTTPS page)
  • 192.168.99.x (for example 171) are not reachable by remote desktop (PCs in the 192.168.99.x are reachable by RDP)
Where is the problem?

Thanks

TM

All Replies

  • PeterUK
    PeterUK Posts: 3,645  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited February 2021
    Can you disable the firewall on the USG and see if its reachable.

    go to network > interface > trunk tab show advanced settings uncheck default SNAT

    make a routing rule network > routing 
    incoming = interface 
    member = lan1
    next hop
    type = interface
    interface = WAN1
    source network address translation =  none

    In advance for routing check “Use IPv4 Policy Route to Overwrite Direct Route”

    edit are you on firmware V4.62 ?

    edit2 after testing here there seems to be a problem with static route for my setup with Zywall 110 and USG60 which I will post my own problem after some testing.

    you might need another rule
    incoming = interface 
    member = wan1
    next hop
    type = interface
    interface = lan1
    source network address translation =  none

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,311  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hi @Max_Tor

     

    You can enter Web-GUI Object > Service > Service Group

    And at "Default_Allow_WAN_To_ZyWALL" tab to add PING service.





    Go to Configuration > System > WWW > Service Control > Enable HTTPS



    You can refer to this link to setup port forwarding for internal RDP service.

    How to setup port forwarding to my internal RDP PC?


  • Max_Tor
    Max_Tor Posts: 8
    First Comment Friend Collector
    Ok, thank you!!
    Today I'll try!
  • Max_Tor
    Max_Tor Posts: 8
    First Comment Friend Collector
    Hello!
    I've tried everything you suggested... but anything works!

    No ping answer and is no possibile to reach admin configuration page at all...

    I've also upgrade to the last firmware available


  • Zyxel_Tobias
    Zyxel_Tobias Posts: 208  Zyxel Employee
    5 Answers First Comment Friend Collector Sixth Anniversary
    Hi @Max_Tor

    I think a call to our support team is the best.

    Please let me know if I allow to use your E-Mail address, I´ll convert this then into a ticket and let someone locally (let me know your country) contact you to check it out by a Remote Session i.e. Teamviewer.

    Thanks.

    Kind Regards,

    Tobias
  • Max_Tor
    Max_Tor Posts: 8
    First Comment Friend Collector
    Yes you can use my email address. I'm in Italy, but I can be contacted from anywhere... speking in english.

    Thanks
  • Zyxel_Tobias
    Zyxel_Tobias Posts: 208  Zyxel Employee
    5 Answers First Comment Friend Collector Sixth Anniversary
    Hi @Max_Tor

    Thank you very much. We will follow up with you.
    Please also check your PM.

    Kind Regards,

    Tobias
  • PeterUK
    PeterUK Posts: 3,645  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited February 2021
    By default you SNAT from your WAN IP on the USG you need to make a rule to not SNAT your LAN traffic for static routes to work that on your FRITZBOX then you can make firewall rules from WAN to LAN.
     
  • Max_Tor
    Max_Tor Posts: 8
    First Comment Friend Collector
    Hello to everybody!
    Today, thanks to Lukas, Zyxel Support technician, we have solved my issue.
    There was a rule that forwarded all traffic of every service to a internal LAN of the USG.

    Deleted that rule and configured some NAT rule to forward traffic and some policy rules to control connection on specified service/port everything work!

    NAT rule:


    Policy rule:


    We've also configured a standard SSL connection.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）