Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to set up a configuration where VPN clients connecting to my Forefront TMG can access all the resources of my Internal network without having the to use the option "Use default gateway on remote network" on the VPN's TCP/IP Ipv4 Advanced Settings. This is important to me, since they can use their own internet while accessing my network through VPN (the security implications of this are acceptable on my cenario)
My Internal network runs on 10.50.75.x, and I set up Forefront TMG to relay the DHCP of my Internal network to the VPN clients, so they get IPs from the same range as the Internal network. This setup initially works, and the VPN clients use their own internet, and can access anything that is on the internal network. However, after a while, HTTP Proxy Traffic from the Internal network starts getting routed to the IP of the RRAS Dial In Interface, instead of the IP of the Internal's network gateway. When this happens, the HTTP Proxy starts getting denied for obvious reasons.
My first question is: does this happen because Forefront TMG wasn't designed to handle a cenario that I described above, and it "loses itself"?
My second question is: Is there any way to solve this problem, either through configuration or firewall policies?
My third question is: If there's no way that it can work with the cenario above, is there another cenario that will solve my problem, and do what I'd like it to do properly?
Below are my network routes:

1 => Local Host Access => Route => Local Host => All Networks
2 => VPN Clients to Internal Network => Route => VPN Clients => Internal
3 => Internet Access => NAT => Internal, Perimeter, VPN Clients => External
4 => Internal to Perimeter => Route => Internal, VPN Clients => Perimeter


share|improve this question
up vote 1 down vote accepted

I have never used Forefront, but using the same IP range for your VPN clients as your internal network only complicates issues. (as you are finding out) You should use a different range for VPN clients, and just have the Forefront box hand them their DHCP IPs instead of passing their requests to your internal DHCP server. Having the VPN clients "use their own internet" is accomplished through split-tunneling, which I am sure the Forefront box should be able to accomplish.

share|improve this answer
Tks so much August... actually, I just used a different subnet, and left things the way the were (not flagged the "Use default gateway on remote network"), and everything worked as it should! I just didn't think it would! Tks so much again! – Pascal Jan 6 '11 at 18:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.