Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I connect to a server on my local network via Remote Desktop. I then need to make a VPN connection out to the internet from within that Remote Desktop session. However that immediately disconnects my remote desktop session.

What's happening here and is there a way I can fix it?

Extra Information:

Local Computer #1:

  • Initiates RDP Session to #2
  • Windows 7
  • 10.1.1.140/24

Local Computer #2:

  • Windows Vista
  • 10.1.1.132/24
  • Initiates VPN connection to public IP
  • VPN is PPTP
  • Set to obtain IP and DNS automatically
  • 'Use Default Gateway on Remote network' is unselected
  • 'Enable LMHosts' is selected
  • 'Enable Netbios' over TCP/IP is selected
  • Has the ability to be multi-homed (ie. has 2 nic's)

Public facing ADSL Router:

  • VPN Server
  • receives connection from #2 via external IP
  • Internal network is 192.168.0.0/24

I can make a VPN connection from my PC with no problems (no RDP involved).

Tom suggested using dual NIC's in a comment below. I have dual NIC's in the box (#2 above) but I'm not sure how to set them up properly, or how to assign the VPN to use one over the other.

I tried setting the extra NIC to be on the same private network (10.1.1.200/24), starting the VPN and then trying to RDP to either of the NIC's, 10.1.1.132 or 10.1.1.200 but didn't have any luck. Is there some way I can tell the VPN to use one NIC over the other?

As requested - here are my routing tables from PC#2:

Before VPN is connected:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.254       10.1.1.132     20
         10.1.1.0    255.255.255.0         On-link        10.1.1.132    276
       10.1.1.132  255.255.255.255         On-link        10.1.1.132    276
       10.1.1.255  255.255.255.255         On-link        10.1.1.132    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link        10.1.1.132    296
  169.254.255.255  255.255.255.255         On-link        10.1.1.132    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.1.1.132    276
===========================================================================

and after VPN is connected:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.254       10.1.1.132     20
         10.1.1.0    255.255.255.0         On-link        10.1.1.132    276
       10.1.1.132  255.255.255.255         On-link        10.1.1.132    276
       10.1.1.255  255.255.255.255         On-link        10.1.1.132    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link        10.1.1.132    296
  169.254.255.255  255.255.255.255         On-link        10.1.1.132    276
      192.168.0.0    255.255.255.0    192.168.0.254    192.168.0.234    267
    192.168.0.234  255.255.255.255         On-link     192.168.0.234    522
    remote-vpn-ip  255.255.255.255       10.1.1.254       10.1.1.132     21
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link     192.168.0.234    522
===========================================================================

I even tried hooking up the second interface (10.1.1.232) and playing with the default routes:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.254       10.1.1.132     21
         10.1.1.0    255.255.255.0       10.1.1.254       10.1.1.232     11
       10.1.1.132  255.255.255.255         On-link        10.1.1.132    276
       10.1.1.232  255.255.255.255         On-link        10.1.1.232    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link        10.1.1.132    296
  169.254.255.255  255.255.255.255         On-link        10.1.1.132    276
      192.168.0.0    255.255.255.0    192.168.0.254    192.168.0.235    267
    192.168.0.235  255.255.255.255         On-link     192.168.0.235    522
    remote-vpn-ip  255.255.255.255       10.1.1.254       10.1.1.132     21
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.1.1.132    276
        224.0.0.0        240.0.0.0         On-link        10.1.1.232    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link        10.1.1.232    266
  255.255.255.255  255.255.255.255         On-link     192.168.0.235    522
share|improve this question
    
Please provide some more information on your setup. In particular, what VPN technology (IPsec, SSL VPN,...), what VPN client, and what kind of routing in the LAN? –  sleske Oct 21 '10 at 8:48
    
Do you have the vpn setup to not route all traffic over the vpn ? if its setup like that, it'll cut you off. –  Sirex Oct 21 '10 at 9:56
    
I've added more information. Also - I've tried having 'Use default gateway on remote network' both selected and unselected. No luck. Thanks for your input so far. –  Dan Oct 21 '10 at 22:41
    
Does all traffic from other hosts on the 10.1.1.0/24 network get rejected by PC#2 when the VPN is active? ICMP (Ping) etc.? –  Goyuix Nov 2 '10 at 23:01
    
Yes Goyuix - that's correct. Pings to PC#2 are only successful when the VPN is inactive. –  Dan Nov 4 '10 at 22:46

8 Answers 8

What's happening is that you're effectively cutting off the IP route from the server to yourself - hence the RDP session loss. You can fix it by setting up the VPN in a way that it's bound to a second interface (physical or virtual) so that both the VPN and RDP link can coexist. How you do this depends enormously on a range of very detailed configurations that we don't know right now, so if you want help with this you'll have to come back to us with a LOT more information, just as much as you can please.

share|improve this answer
3  
+1. That would be my guess as well. I wonder if something like LogMeIn might be an easier solution than trying to figure out a workaround for getting the RDP session to work. –  joeqwerty Oct 21 '10 at 11:42
    
I've added extra information. Thanks. –  Dan Oct 21 '10 at 22:42
    
Put a second NIC in the box, and have the VPN client originate from the one with the default route assigned. –  SpacemanSpiff Oct 29 '10 at 14:28
    
You might be on to something here Tom. See edit in question. –  Dan Nov 2 '10 at 22:58
    
How would that happen, if the remote gateway setting is disabled and he is connecting over the local route (same subnet)? –  Joris Nov 3 '10 at 7:52

This can be usual practice - by default, on a windows box, (this may have changed), all traffic gets forced down the VPN tunnel, so yes, your RDP will drop.

I suggest, going to the advances settings of your VPN on your server, and making sure it doesn't send all traffic via the VPN.

Also, check that the destination network doesn't use the same subnet settings as you do, otherwise again, you'll experience the symptoms you describe.

share|improve this answer
    
Just to check, your actually physically sitting at local computer #1, right? –  Mister IT Guru Oct 29 '10 at 13:39
    
Yeah - that's right. I tried setting 'Use Default Gateway on Remote network' as unselected. No luck. –  Dan Nov 2 '10 at 22:33
    
Also - it is a different subnet, –  Dan Nov 2 '10 at 22:33

I had the identical problem. Check to see if the vpn provider can add you to a group that has a policy set for 'split tunneling' - this is done on the vpn host side and if the server does not have this enabled you will not be able to do what you are trying to.

Seeing that your vpn has the address 192.* when you connect it will destroy the interface you are connecting on (thus cutting you off).

If split tunneling is not enabled on the VPN server (contact the VPN server admin about this!) you will not be able to connect.

This all assumes that you are setting your local vpn connections correctly (it looks like it).

share|improve this answer
    
Thanks - I can't see any option for 'Split Tunneling' on the VPN server. To be clear - I am just using a ADSL router (Draytek) with VPN server functionality built in. It may not have some advanced options... –  Dan Nov 2 '10 at 22:35
    
Does this router have a pptp daemon running? If it does you'll need to turn it off. It could be interfering with the GRE packets. –  Mister IT Guru Nov 6 '10 at 22:16

Hard to tell without more information, but many VPN clients have the nasty habit of (logically) deconnecting their host computer from the LAN while setting up the VPN connection. I.e., you can be connected either to your LAN, or to the VPN, but not both.

If your VPN client does this, obviously your RDP session would be killed as a side effect of cutting you off from the LAN.

I'm not sure why VPN clients do this, whether it's an intentional measure (security?) or just a side effect of reconfiguring the network, but I have often encountered it.

Check the manual for details, and for how to fix this.

share|improve this answer
1  
VPN clients do this to prevent people linking together two networks, (using routing) and stealing all your data from your exposed systems, (or even just being compromised with malware)an attack of this manner will look to originate from system doing the linking, leaving pretty much no evidence –  Mister IT Guru Oct 29 '10 at 13:38

Normally I've used "nested" RDP sessions via VPN with no special problem ( apart a slighty slowering ) The underlying schema was Client->VPN->RDP First Server-> Internet->RDP Second Server. The only problem you could have, I think, is that First server can have a firewall which blocks the outgoing call of RDP Protocol. Using a VPN you can "get in" server network but this is not a warranty that same server or other LAN machines can establish an RDP Session with an external LAN server. If your second server is in the LAN of the first, please check that it can be reached by a RDP Session ( eg: can have a local firewall blocking RDP port ) and Windows allow to use it.The immediate cut off of second RDP session means that there is a network "problem" ( firewalls, auth and so on ) on the route to second server so an accurate check of outbond calls from first server is required. According to me the solution is more simple than you think also if first server have only one network card. For long time I have operated with nested rdp sessions with servers mounting Windows 2000, Windows 2003 and 2008 using a VPN server on Windows 2003 server then nesting RDP sessions for the other two, sometimes toghter, from the first one. So please check network conditions of first server.

share|improve this answer

You mentioned that "Use default gateway" is unchecked - which if that is acceptable (no routing required outside the 192.168.0.0/24 subnet) should have solved your problem.

What you are left with sounds like potentially the firewall getting in the way? Can you completely disable the Windows Firewall (or whatever product you are using) and verify the symptom still exists?

Are you able to reconnect the dropped session after the VPN link has been established, and remains active?

share|improve this answer
    
I've tried with all firewalls turned off and I can't reconnect the RDP while the VPN is active. –  Dan Nov 2 '10 at 22:37

Edit: I missed sleskes' answer explaining the same.

Perhaps some installed security product (firewall, "internet security", antivirus, ...) detects the PPTP connection and has the same functionality?

Note that some of these products have options that are buried deeply in the GUI behind unassuming checkboxes.

share|improve this answer

I had this problem before, and the solution is "split tunneling", this means, send the Internet Traffic to the default gateway, and the traffic to the VPN network using the Tunnel.

What you have to do is set up a static route to your machine in Computer #2. And setting the priority for this route to 0

So the end result will be a default route 0.0.0.0/0 to the IP address of the VPN Gateway, and a static route to your machine using the default gateway.

In windows what you would do is something like this:

 route add 10.1.1.140 netmask 255.255.255.255 <defaultGW> -P

where defaultGW is the ip address of your router.

This will ensure that traffic going to 10.1.1.140 will not be routed to the tunnel.

if you have physical access to computer #2, connect to the VPN and let us know the routing table of the machine:

route print

one before connecting to the vpn and one after.

Whit this information, we can help you up setting the "split tunnel"

Hope to be of assistance

share|improve this answer
    
I added routing tables to the question above. Thanks for your input. –  Dan Nov 5 '10 at 0:11
    
When you connect to the VPN on PC#2, can u still surf the WEB? and if you can, can you check that you are goin out whit the same Public IP? whatismyip.net should give you the IP address you are using to go out to the World. another Question, are you using the windows dialup interface to connect to the VPN or some other VPN client? –  Hugo Garcia Nov 5 '10 at 14:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.