Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OK, here's the deal:

I have a computer (specifically, a MacBook Pro) that is connected to a standard network that is then connected to the big nasty internet. Let's call it foo. It runs a web server on 8084, and so if you were on its local network you could get to this with http://foo:8084/, or, or whatever.

From foo I can VPN into my companies intranet and see a computer on the local company network called bar (another MacBook Pro, incidentally).

Is there any way to set this up so that while foo is on the VPN bar can access http://foo:8084/ (or http://x.x.x.x:8084/, or whatever)?

(From my limited understanding of how VPNs work I have a sneaking suspicion the answer is no, but it doesn't hurt to ask...)

Edit: one more thing, I don't actually admin the network this runs on, my control extends only to the two laptops, and our admins are... well, they aren't going to change any of their settings for this.

OK, more info. The reason I'm lost is I can't get a ping going from a computer inside the network back to the computer connecting via the VPN:

Last login: Tue Apr  6 23:49:47 on ttys000
Nosy:~ stefand$ ssh scdf@bar
scdf@bar's password: 
Last login: Wed Apr  7 18:50:00 2010 from
[scdf@bar ~]$ w
 19:34:21 up 76 days, 20:29,  1 user,  load average: 1.61, 2.00, 2.84
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
scdf    pts/3     19:34    1.00s  0.02s  0.01s w
[scdf@bar ~]$ ping
PING ( 56(84) bytes of data.

--- ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 9000ms    

[scdf@bar ~]$

ifconfig on the VPN'd laptop confirms that IP.

share|improve this question
I thought, once a VPN connection is set up, everything is considered "local network". There shouldn't be a difference between a local and a remote host. – fretje Apr 7 '10 at 7:42
@fretje, as did I. See my update. – SCdF Apr 7 '10 at 7:50

Yes of course you can. You need to set up routing on the VPN server, and on add route on your default router as well.

share|improve this answer
Oh damn, sorry, I should have mentioned I don't actually control my network setup..., sorry. – SCdF Apr 7 '10 at 7:38

By definition, once you set up a VPN you are part of the remote network; if you examine your network interfaces, you'll see you have a new one, which is your VPN interface and has an IP address belonging to the remote network; this is the IP address you must connect to from the remote machine.

If your network is 192.168.1.x and your local IP address is, and the remote network is 10.0.0.x and the remote machine is, when you establish a VPN connection you will acquire a new virtual network interface, which will have an address like; you should connect to this one, not to, which just doesn't exist from the remote network's point of view.

So, if from you try to connect to, it will not (ordinarily) work; if you instead connect to, it should work.

If it doesn't, then either you have a local firewall on your system which doesn't accept connections on the VPN interface, or the VPN server is configured to not let you talk to remote machines and/or not let remote machines talk to you.

share|improve this answer
Some VPN cilent make use of a virtual IP interface and thus the router doesn't handle the client as a local one. Also a serious firewall let you tight VPN connections to tunnel interfaces which usualy belongs to a different security zone than the local network and permits filtering among zones and interfaces. – Maxwell Apr 7 '10 at 12:10

You probably need to ask the admins about filtering between remote VPN dialups (IPs or routes). and the LAN. Seems like http trafic is not permited between the remote host and the lan. When the VPN tunnel is build the routers routes the trafic properly hence your icmp echos.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.