Can only ping one way through a VM router

Question

tl;dr

I have two local networks (one a VirtualBox internal LAN) and a Win2K VM acting as a router between them. I can ping hosts from one network to the other, but not vice versa.

Summary

I am running VirtualBox 4.3.6, with a group of VMs on an internal network (10.0.42.x). All VMs are Windows 2000 Server SP4 (not my first choice, but one makes do with what one has). My laptop is running Windows 7 Home Premium. I am trying to configure one of the servers to route between VirtualBox's internal network and the physical LAN (192.168.1.x) which I'll refer to as the external network for the purposes of this question. The router has a 2nd bridged NIC (so it appears as if it were on the external LAN).

Before anyone asks, as they inevitably do, this is a learning exercise.

Currently

• The router VM can ping any destination in both networks.
• My laptop can ping any guest in the virtual network. I did have to manually add a route in order to accomplish this: route add 10.0.42.0 MASK 255.255.255.0 192.168.1.42. The router appears to be working correctly for traffic going from into the internal network.
• The guests can ping any destination in the internal network, as well as the router's external interface. They cannot, however, reach any host in the external network, such as my laptop or the DSL router (neither of which block ping requests).

Ping requests fail with Request timed out. A tracert yields:

Tracing route to 192.168.1.69 over a maximum of 30 hops

  1   <10 ms   <10 ms   <10 ms  10.0.42.1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  ...

Where 192.168.1.69 is my laptop and 10.0.42.1 is the address of the router's external interface. This suggests to me something wrong with the router configuration, but all I've done is configure RRAS for LAN routing and left it at that, and it's not stopping me from pinging into the internal network.

What I think I can rule out

• Firewalls (every host involved responds to pings from somewhere).
• Typos (I've copy pasted extensively to the point of paranoia to avoid mistakes).

What I've tried

• Removing & reconfiguring RRAS.
• Added a default route to the guests (route add 192.168.1.0 MASK 255.255.255.0 10.0.42.1).
• Added default gateway to router's NICs (didn't think it would help, and it didn't).

Specifics

More details on request; this question is probably long enough as it is.

Laptop
IP 192.168.1.69/24
Default Gateway (DSL router)

Router
IP 192.168.1.42/24
IP 10.0.42.1/24

Guest
IP 10.0.42.128/24
Default Gateway 10.0.42.1

Route tables

I've included the routing tables for the guest that cannot ping outside its own network (this is actually a different guest (10.0.42.254), but like all guests besides the router, it has the same issue):

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        10.0.42.1     10.0.42.254       1
        10.0.42.0    255.255.255.0      10.0.42.254     10.0.42.254       1
      10.0.42.254  255.255.255.255        127.0.0.1       127.0.0.1       1
   10.255.255.255  255.255.255.255      10.0.42.254     10.0.42.254       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0        10.0.42.1     10.0.42.254       1
        224.0.0.0        224.0.0.0      10.0.42.254     10.0.42.254       1
  255.255.255.255  255.255.255.255      10.0.42.254     10.0.42.254       1
Default Gateway:         10.0.42.1

Answer 1

When one host successfully pings another:

An ICMP Echo Request packet is assembled by the originator, route tables are consulted, an interface is selected, and the packet is shipped off to the lower OSI layers, to the target host.

The target host receives an ICMP Echo Request addressed to itself, notes the IP address of the requester, and formulates an ICMP Echo Reply, consults its route tables, selects an interface, and ships the Reply back to the requester.

The requester receives the ICMP Echo Reply, notes the time it took to complete the send-receive loop, and notes it to the user.

At this point, a packet has gone from A to B and another has gone from B to A, with success.

This confirms that A can get to B, and B can get to A.

This ought to be the end of it, but for some reason, B cannot send an Echo Request to A, or A cannot send an Echo Reply to B.

Verify what IP addresses are used when A successfully pings B, and ensure that they're what's being used when B attempts to ping A.

Is it a problem with the ping program? Can the two systems reach each other via TCP? (telnet B 25 A connection refused is expected; a hang means the data is getting lost along the way.