I am trying to set up VPN using routing and remote access.
I've tried two configurations, one using a single network card, and one using two network cards.
I can connect through my VPN and get assigned an IP address by the DHCP server, but I can't "SEE" anything. By this I mean the client appears completely blind to the office network, this means:
- No ping to any office server including the VPN server (I've stopped ICMP being filtered in and out)
- No DNS resolution (isn't surprising if I can't connect by IP address. I tried accessing the VPN Server Share and a web page hosted on it using the domain name and the IP address, e.g. http://host.com/abc and http://220.127.116.11/abc)
- Can't access any network resources (also not surprising given the above)
I've not had any problems connecting the VPN at all (I thought I had, but this was to do with the test router I given).
This doesn't appear to be a firewall/router problem as I configured it to allow VPN traffic through and forward to the correct server.
This, I think, is confirmed as the VPN server event logs shows success audits (that is, logon events).
However it does show the following event directly after the success audit logon event occurs (and I don't know if this is normal but wouldn't expect it to be - the VPN client doesn't disconnect).
An account was logged off. Subject: Security ID: [DomainName]\[UserName] Account Name: [UserName] Account Domain: [DomainName] Logon ID: 0x[xxxxxx] Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
I am not sure if this is of any use, but Wireshark shows me connecting successfully and then a load of encrypted packets, which is what I would suspect:
- There's a PPP LCP/CHAP configuration conversation which is the client connecting.
- I don't see any ICMP on either side when I do a ping to the VPN public interface (I assume this is because it is encapsulated on the GRE packets).
However the following is interesting (which I can't explain):
- Pinging the public interface (A) (of VPN Server) I see increased PPP and GRE traffic
- Same if I ping the private interface (B) (of VPN Server)
- If I ping another server (C) on the network I can see the ICMP packet requests but no replies (I'm not sure if (C) server is replying directly to the VPN IP of the client (D) or not - this does appear the case as I see the traffic in (A))
I can't explain points 1 or 2 - I'd expect to see ICMP, but the problem does appear to be sending traffic to (D). To check this I pinged (D) from (C) and RECIEVED a reply, however I DID NOT see correlating ICMP traffic on (D) (could this have been GRE traffic?). I find this strange, but (C) is definitely pinging the correct machine as it stops responding when I disconnect (D) from the VPN.
Also note, I don't see any traffic on (D) to the VPN network addresses, only to the routers which have the port forwarding set up. Could this be some sort of routing problem?
The VPN server does seem to have a problem pinging the (D)- says NO RESOURCES, PathPing shows it is using interface (A). and this problem only occurs when pinging (D), it pings everything else without problem.
I changed RRAS to single NIC setup and the no resources problem went away - I can seemingly ping the client from all machines, but can't ping anything from the client. I say seemingly as when I ping the client it takes less than 1 ms (bear in mind this is across the Internet and different ISP's) and I don't see any ICMP traffic on the VPN server - plus when I disconnect the client, it is still pingable!?! (As if the VPN server is replying to pings on the client's behalf.) Whilst this is happening the VPN server gets timeouts when it pings the disconnected client. VERY STRANGE!
After leaving it for some time (drinking tea, eating food sort of length) the VPN server has gone back to the No resources problem, and not I have no ping in either direction. Disabling RRAS and enabling it again put me back to where I was just now, I can now ping from LAN to client.