Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am inside an Active Directory (AD) domain and trying to trace route to another AD domain at a remote site, but supposedly connected by VPN in between.

the local domain can be accessed at 192.168.3.x and the remote location 192.168.2.x. When I do a tracert, I am suprised to see that the results did not show the intermediate ISP nodes. If I used the public IP of the remote location, then a normal tracert going through every intermediate node would show.

1    <1 ms    <1 ms    <1 ms
2     1 ms    <1 ms    <1 ms
3     7 ms     7 ms     7 ms  212.31.2xx.xx
4   197 ms   201 ms   196 ms
5   201 ms   201 ms   210 ms []
6   209 ms   209 ms   209 ms
7   209 ms   209 ms   209 ms  COMPANYDOMAIN []

Can someone explain how does this VPN tunnelling works? Does this mean VPN is technically faster than without?

share|improve this question
I suggest taking a few moments to read up on VPN concepts, which will explain this and many other questions you may have. – John Gardeniers Dec 30 '10 at 4:14
@John. I tried to, and on many other occassions as well. But most text require many other advanced concepts and it's hard to following along given my limited understanding. – Jake Dec 31 '10 at 10:38
in a nutshell: A VPN comprises two layers of traffic. The outer layer does all the routing and knows about the nodes it passes through. The inner, secure, layer knows only the two endpoints and doesn't even see anything else along the way. – John Gardeniers Jan 1 '11 at 6:39
up vote 4 down vote accepted

VPNs use tunneling to get packets from one end to the other. You wont see those hops . If you want to locate a problem router or failed router to the end point you must route your icmp packets outside the tunnel using the wan interface.

VPN is a bit of a broad term, it can use many types of encapsulation. Most commonly PPTP (point to point tunneling protocol) is used. More often than not with the use of IPSEC to secure the transmission.

(Avoid adding a PBR by just doing a traceroute from the router/firewall that the VPN is established from)

share|improve this answer
the word "encapsulation" suddenly made everything seem much clearer. thanks for the hint. – Jake Dec 31 '10 at 10:39
glad to hear it. – Ablue Dec 31 '10 at 16:11
I remember none of this really made a lot of sense for me until ccna. If you are interested there are some really good tutoring videos from 'train signal' that make it easy to understand. – Ablue Dec 31 '10 at 16:20

If there is a site to site VPN setup between your two locations a trace route to the remote site will show less hops then a trace route to the Public IP of the remote site because the first trace route is not showing the nodes that the site to site is doing for you

It does not necessairly mean your VPN connection will make it any faster, in reality with the overhead of the VPN it can sometimes be slower but performance will depend on the type of VPN connection and speeds of all connections involved.

share|improve this answer
I'm not sure exactly what you're saying but Matthew's answer is correct. – joeqwerty Dec 30 '10 at 4:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.