ok here goes.
I have a srx240 which I'm setting up a dynamic VPN on. if I use the an IP pool within the range of the protected servers and use proxy-arp on the internal interface then everything is fine.
However I want to allocated the remote clients a seperate IP range but when I change the pool details, connection again is fine, clients connect get the correct new IP but no access to any services.
If I look at session flow I see the traffic going in and out the correct interfaces with th ecorrect IPs but nothing goes to the client, it's almost as if the firewall doesn't know to route it back down the tunnel.