Network diagram

Consider the following network ^^^.

The virtual network setup in Azure: with 1 subnet, and a gateway subnet at

Azure knows how our network looks like, 2 address spaces: & via an additional router.

I would like to achieve bydirectional communication from & to Azure.

At the moment we set it up with a machine on-premise (with IP which runs Windows Server 2012 R2 with RRAS. It dials in to Azure, and we have connection.

The first route on RRAS is This ensures that any machine in the local network ( can reach the Azure network. The second route is, this is to ensure that Azure can talk to us. Question: What should be the gateway here: (the DHCP server) or (the RRAS server)

The third route ensures that any traffic that comes in to the RRAS server that wants to talk to the network is forwarded to, which is the 3G modem/router.

Now we're missing a piece, but let me first explain what works:

  • A machine in Azure can ping anything in the
  • A machine in our on premise network ( can ping anything in Azure (
  • A machine in our on premise network ( can ping anything behind the 3G modem (

BUT (and this is my next, and most important question) no machine in Azure can ping the 3G network UNLESS I add a static route on the 3G modem/router that says: to gateway

How come the 3G modem/router doesn't know how to redirect the traffic back to, after all it has that particular IP as Gateway.

Is it because 10.*.*.* and 192.168.*.* are not routable?

Update: went to look in the 3G router/modem and found this:

#> display route

 Route Table:

 Destination         Gw              Refs Mhome Iface    mtu  hops ttl         flags      1    0     mobile0  1500 1    INF         UGS  2    0     eth0     1500 1    INF         UGS      *               1    0     mobile0  1500 0    INF         UC       1    0     LOOPBACK 1500 1    INF         UGJS       6    0     LOOPBACK 1500 0    INF         UH    *               1    0     eth0     1500 0    INF         UC

It seems that the first one 'eats' all network, and the second one (that is the static route I've added) fixes that. And the last one is because he knows he's on the network. It is weird though that there's no gateway address there.


I'd be surprised if you need a static route on the RRAS server for at all, as it is a "directly connected" network - the RRAS server should know how to get to that network without a static route configured. In any event, setting the gateway for as the RRAS server's IP on that network is functional, as you have discovered (this is effectively what connecting an interface to a subnet does by default), but will break if the RRAS IP changes on that network, so it's probably easier to remove the static route.

Without a configured route, the 3G router has no knowledge of the subnet as it is not a directly connected interface, so will, without any further instruction, send traffic to that subnet over it's default gateway (most likely, directly to the internet). If it doesn't have a default gateway, the traffic will simply go nowhere.

The static route is required on the 3G router to tell it that traffic for has to be directed to the RRAS server on as that is the correct gateway for that subnet.

The reason azure machines can't ping machines in without that route is because although the azure machines can get to the subnet (there are correctly configured routes in that direction) the replies from those pings can't get back without the routes in the reverse direction being configured properly.

Let's take an example of an icmp echo request between two IPs: sends an echo to
The Azure setup knows that the RRAS is the gateway for
The RRAS knows that the 3G router is the gateway for
The 3g router sends the packet onto the network for receives and generates a reply has a default gateway of the 3g router, so it sends it to the 3g router
the 3g router has no path to, and drops the packet or sends it to the default gateway of last resort (which is clearly not the RRAS server, or another route is overriding the default gateway) - the packet is lost

  • Thanks for the answer Phil, The first route needs to be there because otherwise the VPN in Azure doesn't send the traffic to me. That's how it works apparently. The thing is, the 3G modem has the .36 as standard gateway. That's what bothers me. Or does he think that belongs to the other side of the router (i.e. the 3G network itself?) – Snake May 9 '15 at 14:34
  • The first route, or the second route? I was talking about the "second route" eg the static route on the RRAS that points to the gateway This routing information should be known (unless RRAS has it's own routing table that we're talking about?) – Phil May 9 '15 at 14:35
  • If the 3g router has as it's default gateway, there must be a more specific (more specific than, I mean) route on there that is causing traffic for to be sent elsewhere in the absence of a specific static route. Many 3G networks issue WAN IPs in the 10 range and use carrier grade nat, so it could be related to that. – Phil May 9 '15 at 14:37
  • the route I mentioned the is required for Azure -> local connections. For your second comment: Then that must be it. Thanks! – Snake May 9 '15 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.