Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a problem what I believe is a routing issue but I cannot solve it. Current setup on my company is like this schema

In current setup,

  • every client can access to internet using CLIENT => MAIN => MODEM
  • every client can access to WEB using CLIENT => MAIN => MODEM => WEB
  • WEB cannot access behind MAIN

now, for one specific case, our WEB server needs to access one of the clients, say CLIENT 1. I could not manage to create such route. could someone please explain me how to accomplish such task and describe me how.

I tried to create a route on WEB like this

route add mask

and tried to create another rule on MAIN using RRAS. It did not work and I deleted it and all clients are disconnected from internet. only a reboot recovered. problem is I don't remember the route added.

servers are Windows 2008 R2, clients are Windows 7

any help is appreciated

UPDATE 1: Added route tables

route tables

share|improve this question
Does MAIN perform NAT on the subnet? – AndresSM Feb 1 '13 at 18:29
It seems NAT is enabled on RRAS on internet interface – edokan Feb 4 '13 at 9:39
Please share the routing tables on the involved systems and which systems do NAT. – fuero Feb 4 '13 at 11:40
added route tables. hope that will help. thanks. – edokan Feb 4 '13 at 12:58
Is it a specific service Web need to access at client? Is that requirement fixed or keep changing? – John Siu Feb 7 '13 at 3:14

If WEB has the modem as default gateway, you have to add on the modem a route pointing subnet to MAIN. From MAIN, since the clients are direct connected, you don't need any additional route.

Otherwise, if WEB has MAIN as default gateway, you may have a firewall problem, and not a routing issue.

share|improve this answer
I added a route to WEB to route traffic to over Then I pinged and ping fails on – edokan Feb 4 '13 at 11:19
Have you tried tracert? Do you have netmonitor or wireshark installed on MAIN? – fboaventura Feb 4 '13 at 12:06
tracert shows timeout error after that's after I created the route. no, neither netmonitor, not wireshark is installed, but I can install if it will not disconnect anyone. – edokan Feb 4 '13 at 12:28
it will disconnect everyone. But, you already know that your routing is working fine. Now it's just a matter of firewall rules on your windows server. – fboaventura Feb 4 '13 at 14:45
You don't need the route to to be added to MAIN. And if you have the route added to your modem, you don't need it on WEB – fboaventura Feb 4 '13 at 15:42

You need to disable NAT on the RRAS then, I have never used it but assuming it's semi competent you should be able to selectively NAT based on destination, try to tweak NAT so it doesn't nat traffic destined to

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.