Hi,
Your saproutab seems wrong : sapserv2 public IP is 194.39.131.34 not 147.204.2.5.
nor 194.117.106.129 ( which is the one for VPN connection to SAP ( sapserv1 )
That said, your saprouttab should look as follows :
#SNC connection to SAP
KT "P:CN=sapserv2, OU=SAProuter, o=Sap, C=DE" 194.39.131.34 *
# inbound connections MUST use SNC
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.0.13 3200
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.0.13 8100
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.0.13 3299
# Connection from sap to internal system
P 194.39.131.34 192.168.0.13 3200
# Access from the local network to SAP
p 192.168.0.13 194.39.131.34 3299
# all other connections will be denied
D * * *
HTH, Best regards,
Steve.