VPN connected but internal subnets unreachable Networking Origin: Network OSI layer 3 · Network Last updated 5 Nov 2026

Networking: VPN is connected but I can't reach the internal network — missing routes, split tunnel or overlapping subnets

The tunnel is up, but traffic for the office/VPC subnets isn't sent through it or comes back the wrong way.

Exact message you may see VPN connected but cannot access internal networkVPN connected but no access to internal resourcescan't ping internal IP over VPNoverlapping subnets VPNsplit tunnel route missing
Explore the map of this error Full error map →
Seen on: Linux Windows Networking

Meaning

Check the client routing table for the remote subnet (ip route / route print), the server's pushed routes or AllowedIPs, and whether your home LAN uses the same subnet (e.g. both 192.168.1.0/24). Fix by adding the route, changing the local subnet, or correcting split-tunnel settings and return routes on the remote side.

Common causes

  • Remote subnet not in AllowedIPs / pushed routes
  • Home and office subnets overlap
  • Split tunnel excludes the destination
  • No return route on the remote router
  • Firewall on the VPN server blocks the forwarded traffic

⚡ Quick fix

  1. Show routes: ip route / route print for the remote subnet
  2. Change the local LAN subnet if it overlaps
  3. Add AllowedIPs/routes and ensure IP forwarding on the server

Detailed fix by platform

Linux

  1. bash
    ip route get 10.20.0.15
sudo wg show   # AllowedIPs should contain 10.20.0.0/16
sysctl net.ipv4.ip_forward

How to diagnose

  1. Route — Present via tunnel?
  2. Subnets — Overlapping?
  3. Return route — Exists?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

Connections hang on large transfers (PMTU black hole) — Networking: SSH/HTTPS connects but hangs on large data — path MTU discovery black hole (Networking)Connections hang on l…Internal hostnames fail on VPN (split DNS / systemd-resolved) — Networking: VPN connected but internal names like db.corp.local don't resolve — split DNS / 127.0.0.53 stub resolver not using the VPN DNS (Networking)Internal hostnames fa…NO_PROPOSAL_CHOSEN (IPsec/IKE) — Networking: IKE: received NO_PROPOSAL_CHOSEN — IPsec peers can't agree on encryption, hash or DH group (Networking)NO_PROPOSAL_CHOSEN (I…OSPF neighbor stuck in EXSTART/EXCHANGE — Networking: %OSPF-5-ADJCHG: Nbr 10.0.0.2 from EXSTART to DOWN — OSPF neighbor stuck in EXSTART/EXCHANGE (MTU mismatch) (Networking)OSPF neighbor stuck i…Reply from 192.168.1.1: Destination host unreachable — Networking: ping — Destination Host Unreachable / Destination net unreachable (ICMP type 3) (Networking)Reply from 192.168.1.…WireGuard: Handshake did not complete after 5 seconds — Networking: Handshake for peer did not complete after 5 seconds, retrying (try 2) — WireGuard tunnel never establishes (Networking)WireGuard: Handshake …Wrong subnet mask: hosts can't reach each other — Networking: Two hosts on one LAN can't talk — subnet mask or network address mismatch (Networking)Wrong subnet mask: ho…VPN conne…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.