Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have three offices all with broadband routers feeding into Server 2003 running Routing and Remote Access that provides the clients with internet access.

I have setup VPN connection between site1 and Site2 and between site1 and site3, however I want to setup a VPN connection between site2 and site3 but this is giving me problems.

Server at site1 can ping the router and server at site2 and site3 no problems, but site2 and site3 can not ping each other or each others router.

Any one have any idea why these two servers can't communicate with each other?


I have been trying tracert to see if that gives me any clue where the problem is. To save giving out my IP address on a public forum I will use the following notation.

Server1 - server at site1, router1 router at site1 etc

router1 has ip of a.b.c.89
router2 has ip of d.e.f.217
router3 has ip of d.e.f.249

server1 a.b.c.90
server2 d.e.f.218
server3 d.e.f.250

so tracert of d.e.f.217 or 249 from server1 completes no problem as stated before.

tracert d.e.f.217 from server3 gives Destination host unreachable d.e.f.249 and tracrt d.e.f.249 from server2 gets as far as hop 2 before timing out.

Could it be anything to do with the similarity between site2 and site3's IP both having identical first three numbers?

share|improve this question

You may not have this luxury, but I'm curious - if you disconnect site1 from site2, can you then connect site3 to site2?

My theory is that the external IP from 3->2 is being suppressed, due to the VPN wanting those sites to route internally.

share|improve this answer
It is not easy to test as I am based in site1 and site2 and site3 are the other end of the country with no sysadmins on site. I do not think it is being blocked by the exisiting VPN connection because we had mutiple VPN's working in a test network before the servers moved to site2 or site3. Especially as the routers can not be pinged but can be from site1. – Simon Foster Jun 2 '09 at 16:23

Are all sites connected to the internet with the same ISP and broadband modem?

Are there firewalls in front of your W2K3 machines? If so (and there should be!) make sure NAT and Access Rules are configured properly.

You should make sure you have static IP set for all sites. You should check Windows Firewall settings for all computers. Check all logs on all routers and computers involved. [Edit] This article has a good one-two approach:

share|improve this answer
I have static IPs for all servers and routers in each office. My Firewall is correctly configured as site1 can connect fine to site2 and site3 fine. Something is blocking connection between site2 and site3. I have been through network connection and RRAS and they look identical on each server so it is really bugging me why this isn't working. – Simon Foster Jun 2 '09 at 10:50
I'd look at the Event log first of all, if it gives any clue to what is happening. Then I'd look at the RRAS logs, of which there could be a few. This article has a good one-two approach: – tplive Jun 3 '09 at 6:09

I have never done this with Windows VPN to connect sites, but using router to router VPN I needed to setup a new route using the route command so that computers knew where to find each other on the otherside of the VPN

Example: VPN1 - VPN2 - VPN3 -

I have to tell basicly any computer on VPN1 that wanted to get to VPN2, that for the IP range of they needed to go though router gateway to get to

Don't know if this is the case in your situation, and I'm not a expert in this at all. Try googling route and it may explain it better.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.