TL-ER6120 site-to-site VPN doesn't route outgoing traffic?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

TL-ER6120 site-to-site VPN doesn't route outgoing traffic?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
TL-ER6120 site-to-site VPN doesn't route outgoing traffic?
TL-ER6120 site-to-site VPN doesn't route outgoing traffic?
2015-11-30 23:28:06 - last edited 2021-08-21 04:58:10
Model :

Hardware Version : Not Clear

Firmware Version :

ISP :

There's been a number of threads dancing around this issue without arriving at a definitive solution. I've bench tested a number of VPN routers (mostly Cisco) with "LAN-to-LAN" or "site2site" IPsec tunnels with each other and the ER-6120 is the only router that doesn't seem to route outgoing traffic. In fact not at all !

From the local LAN of other routers I am able to ping the local LAN's of other routers including the ER-6120. But from the ER-6120's local LAN is a different story. I can't ping a thing outside its own subnet. I've tried everything I can think of including restoring factory settings and starting over. I've even set its firewall Access Rules to allow all services to both LAN and WAN -- nothing.

Setting up a Site-to-Site IPsec tunnel with an ER-6120 isn't a problem ( though the "responder" option seems to be missing). But despite whatever I try, traffic from behind an ER-6120 is a one-way street, incoming but not outgoing. Even pinging from the ER-6120's Diagnostics web UI only returns is " Destination host cannot be reached." To me, that points to a routing issue. Yet an entry appears in the routing table for every IPsec tunnel created. But doesn't allow static routes to be added to the same destination, which forgoes that workaround attempt.

So I am at a complete loss. Unless I am missing something simple or some hidden workaround, I find it hard to believe that a major bug such as this -- a VPN router that can't site2site -- has never been resolved -- in years! And they still sell this thing? WTF? Logic dictates it's something I've missed, a hidden quirk. But what?

Can anyone shed some light on this?
  0      
  0      
#1
Options
1 Reply
Re:TL-ER6120 site-to-site VPN doesn't route outgoing traffic?
2015-12-24 17:10:53 - last edited 2021-08-21 04:58:10
Why you are so sure that it is the ER6120's fault? From your description, I think there may be some factors on the Cisco side that block the traffic from the ER6120.

Firstly, just think about again, the Ping date from the Cisco LAN can reach the ER6120's LAN side, it means the traffic from Cisco to ER6120 is OK; but the Ping date from the ER6120's LAN can not reach the Cisco's LAN side, it means the traffic form ER6120 to Cisco is broken. Is not there more chance that there is something wrong with Cisco's router?

Secondly, if you suspect the date from ER6120's LAN side had not passed the ER6120's WAN, why not to do a simple test? Using the Port Mirror function, set the WAN port as mirrored port and designate a LAN port as mirroring port, connect a PC to the mirroring port and running Wireshark or other packets capture software, and ping the Cisco's LAN IP from the PC's CMD Line. From the packets you captured from the WAN port, you can see if there is date out from the LAN side. But please take in mind, all the packets will be encrypted, but you can check the change of the IP address.

Lastly, please do not do the ping test in the Diagnostics in the web UI, I think it may be designed for general date traffic but not the date through the VPN tunnel.

I have never encounter such a problem, and I have no offense, but from your description, I read deeply prejudice. Yes, the Tp-link is not as outstanding as Cisco now, but we should discuss the problem fairly.
Hope you can solve your problem soon.
  0  
  0  
#2
Options

Information

Helpful: 0

Views: 771

Replies: 1