Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a volunteer network admin for a multi-tenant non-profit office space. One of our new tenants uses a VPN to connect to remote resources using RRAS and Small Business Server 2008. They also have a local network printer for the workstations in our office. When connected to the VPN, they cannot print to the local printer.

I informed their network admin that they need to enable split-tunneling to fix this. Their network admin enabled split-tunneling, but apparently printing still didn't work. He told me that I need to open port 1723 on our office firewall to allow it to work. I'm just a novice administrator and not familiar with RRAS, but this doesn't sound right to me and I haven't been able to find anything on the web to validate it. Additionally, my understanding of split-tunneling is that it is handled entirely by the VPN client and should work irrespective of firewall settings.

Is my understanding of the situation incorrect? What steps should I take to resolve this problem?

share|improve this question
up vote 1 down vote accepted

The split-tunnelling setting is often only about DNS, so your tenant also needs to check:

  1. that he/she doesn't have 'use remote gateway' enabled, i.e. when the VPN is running, can their computer get to the internet without going through the VPN tunnel?
  2. that their VPN client allows local LAN traffic

These two options might be covered by the same setting...

share|improve this answer
Thanks for the help. This did point me in the right direction. I found out that the remote and local networks are on the same subnet and that appears to be causing the conflict. I'm not sure how to get around that at this point, but I'm looking into it. – Marve Feb 25 '11 at 5:14
There's VPN solutions that can cope with this, but it would mean setting up the client so that ALL its traffic is sent through the VPN tunnel (something you don't want), or you start setting up static routes for specific (printer,server) IP addresses, not nice. So just change the subnet of one of the networks. – DutchUncle Feb 25 '11 at 15:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.