I have configured as an OpenVPN server (Debian) and other servers in Azure network which is connected to on-premises network ( via site-to-site VPN IPsec tunnel.

Connection was established between Virtual Network Gateway on Azure and local Paloalto. Network connection from azure to local network works fine:

( <------>

On the openvpn server's been configured point to site vpn for clients with address space From client to Azure communication works well:

( <----->

but I have a problem in that, when I attempt to ping on-premises network (

Not connection between ( <- ------/------- ->

Pinging (DNS on local site) from (Client connected to OpenVpn)

I received (request timeout): Packets captured on Vitual Network Gateway Azure: ICMP 130 Destination unreachable (Port unreachable)

(Here rather than address we can se OpenVpn Azure Interface, despite masquerade is disabled and routing and packet forwarding is enabled.) Tcpdump Openvpn: IP > ICMP echo request, id 1, seq 970, length 40 OpenVpn server shows tcpdump requests from to but not reply.

What’s more on PaloAlto (Local Network) I can see requests from and reply from but packets not reach the network, it looks like packets were lost before enter to azure network.

Route table shows (OpenVpn):

default via dev eth0 via dev eth0 dev eth0 proto kernel scope link src via dev tun0 dev tun0 proto kernel scope link src is OpenVpn interface on Azure

Azure route table:

Name | Network | Next Hop Type

ToAure | |

ToLocalNet | | VirtualNetworkGateway

Any thoughts as to why I'm not getting to local net from client net? Thanks very much for your help!

1 Answer 1


Did you announce your (client's address space) in the s2s vpn between palo alto and azure vpn gw ?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .