Is this expected behaviour of traceroute in VPN tunnel?

Simple site-to-site VPN configured, no GRE/DMVPN/EasyVPN.


<protected subnet> ----<--WAN--> --<protected network>

The interesting traffic to be protected is between and

The tunnel is setup and working, and hosts on the subnets can access each other.

Now using Windows traceroute (ICMP based?) - a PC,, does a  traceroute to

(which is the interface of GW2 on the other protected subnet)

!!Case 1

1. 3ms 3ms 3ms

2. 3ms 3ms 3ms

This behaves exactly like a non-VPN situation and shows 2 hops to the destination.

However if I traceroute to a host on the other protected subnet (i.e. not GW2's protected interface):

!!Case 2

1. 3ms 3ms 3ms

2. * * * timeout

3. 3ms 3ms 3ms

Note that the traceroute "succeeds" and shows 3 hops to destination (as one would expect).

My question is why does the 2nd hop (i.e. the other gateway/tunnel endpoint) timeout, more precisely,

I certainly wouldn't expect it to reveal it's public addresses, but why doesn't it discern a 2nd hop node of

that it did  in the 2-hop Case 1?





Sign In or Register to comment.