Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site to site VPN configured between our main site (Site A) and a remote site (Site B).

Site A is Site B is

The firewall in Site B is a Juniper SSG running ScreenOS 6.3 and I'm using a route based VPN.

The tunnel works perfectly in that from Site A you can reach via the tunnel, and from Site B you can reach via the tunnel.

However, we want it so that if you're in Site B and want the Internet it goes via the firewall at Site A, and right now on the Juniper has the ISP router as next hop.

My understanding is that on the Juniper, I can set a route for the /32 public IP at our main site that the VPN tunnel connects to to the ISP router via ethernet0/0 (the SSG's external interface), and then modify the route to use our main site firewall via tunnel.1 (the VPN tunnel).

Not sure I've explained that so well but is my understanding correct?

share|improve this question

That's it precisely. I've been doing this for some time with JunOS/SRX devices as well for trade shows over seas. Since many content providers like hulu restrict content to the US, redirecting the gateway permits us to do demos while appearing from the office. It can be a bit slower due to the extra round trip time, but it works at least. Once there's a route-based tunnel set up, it's as easy as 'set route remote-ip/32 int untrust gateway defgw; unset route; set route int tunnel.1'. You'll definitely want to make sure you are logged in through the VPN or you'll lose access to the box and someone will have to power cycle it (or login locally).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.