SBS 2011 on different subnet than domain computers

Question

The setup is as follows:

1. SBS 2011 in datacentre on subnet A
   
2. Domain PCs at another location on subnet B
   
3. There is a site-to-site VPN.

The domain PCs have joined the domain and have the SBS as their primary DNS server.
The domain PCs can ping the DC but the problem is that the DC cannot ping any of the remote subnet (subnet B)

SBS --Switch -- Router A ------------------- Router B -- Switch -- Domain PCs

What is strange is that router A can ping any host on the subnet B.
Another host on Subnet A can also ping any host on subnet B.
It's only the DC which cannot ping anything to that specific remote subnet B.

I did a tracert from the SBS to router B. The packet reaches Router A from the SBS but then it fails.

Am I missing some specific settings that needs to be done when SBS is on a different subnet than its member pcs ?

Answer 1

It sounds like there is a config issue with either your VPN or router. Double check ACLs and routes.

Side Note: having no DCs at a location is generally a bad idea.

Answer 2

It appears that the issue was with the router and more specifically private-to-public address mappings.

The SBS talks to the outside world with its own public IP while other hosts on the same LAN uses another public IP.

I am referring to a particular router in use here (Draytek 3900)

I disabled the specific private-to-public IP mapping for the SBS server and traffic to the remote subnets became possible.

So, it's confirmed that the issue is NOT with SBS settings but rather with the router.