Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I would like to have some more understanding of lower level/details how VPN(Lan to Lan connection) works. I tried to read on internet but no details are available, hence asking here.

In my office location UK, we have a VPN server a Draytek Vigo 2910, at say office 1, I have 2 VPN settings configured in this UK draytek router configuration tab:VPN and Remote Access :-

1) First VPN is configured with Call direction as dial-out to Ireland, Lan-to-Lan setting enabled to our second office location there, where the Server IP/Hostname for VPN is mentioned as a url obtained from registering with DynDns[dynamic DNS] say mvdub.dnsalias.com, This VPN link works fine and we can access the computers/intranet sites from the other LAN at office 2 from our Lan at office 1, fine.

2) Then there is second VPN configured with Call direction as Dial-In, from our Romania location. In this setting, we have set the Peer Caller ID or Peer VPN Server IP the IP address of the Romania office location VPN server/host. This link is what does not work. What I mean is we cannot access the computers inside this remtoe LAN at office 3, from our local LAN. This second link was working before we moved our office recently to a different physical location locally.

My questions:

1) What settings should I be looking in the Draytek to resovle this VPN access error. I am confused about in the case of connection 1) which works, whether the Lan to Lan VPN connection is using Dynamic DNS to resolve to the VPN server IP address or is it using Static IP address of the VPN server(I hear that the VPN server in office2 have obtained static IP address for their VPN host. If its using static IP address what is the Dynamic DNS url xyz.dnsalias.com doing ? How is it helping?

2) Second question is - I also connect from my home to my office VPN in office 2(Office 1 , where I work is still not accessible, after we have moved locations). On my home computer I have setup a VPN connection wherein I have mentioned the IP Address of the VPN server as xyz.dnsalias.com. How does it get resolved to the static IP address of the remote VPN server in office 2. Does it need to get resolved or it can just grant me access based on the hostname/url xyz.dnsalias.com?

Sorry , if I come across as confused, but thats because I am!

Any pointers, explanations would help immensely.

thank you.

share|improve this question
So are the routers both connected to office 1 or is office 3 connected to office 2? (2<-1<-3) or (1->2->3) ? – Jaydee Oct 17 '11 at 10:13
This wall of text needs to be cleaned up with descriptive location names, static IP addresses (or dynamic DNS names), and what LAN-to-LAN VPNs work, and from where so we can understand what it is you're talking about. – gravyface Oct 17 '11 at 10:24
@Jaydee:Setup is as shown: Office 1 router has dial-out VPN to office 2. Office 1 has dial-in VPN from office-3. Office--3 has dial-in VPN to office-2. Is that what you asked? – goldenmean Oct 17 '11 at 10:39
@gravyface: Have edited the OP with some mroe details. Please re-read. – goldenmean Oct 17 '11 at 10:45
When you physically moved offices, did your UK address change? – gravyface Oct 17 '11 at 10:48

1 Answer

up vote 1 down vote

What settings should I be looking in the Draytek to resovle this VPN access error. I am confused about in the case of connection 1) which works, whether the Lan to Lan VPN connection is using Dynamic DNS to resolve to the VPN server IP address or is it using Static IP address of the VPN server(I hear that the VPN server in office2 have obtained static IP address for their VPN host. If its using static IP address what is the Dynamic DNS url xyz.dnsalias.com doing ? How is it helping?

Dynamic DNS is a service that was likely setup because you didn't have a static IP address (these usually cost more per month from your ISP). The UK VPN router, like any machine, is using DNS to resolve xyz.dnsalias.com to the WAN IP address of the Romania VPN router, provided Romania is still updating dnsalias.com automatically with a dynamic DNS client (on a computer on their network or in the router itself).

What this means is that in order for dynamic DNS to work, there has to be a piece of software running on a computer or on the router itself that periodically updates the dynamic DNS service provider with the WAN IP address so that if it changes, this new IP address replaces the IP address that somehost.dnsalias.com resolves to. As for the router, well, routers (in the simplest sense) communicate at layer 3 (IP addresses); DNS is just used to get an IP address so that it knows where to try to initiate the VPN with.

If Romania stopped updating the dynamic DNS service (by disabling the dynamic DNS client in the router or on a computer) and now have a static IP address, then the UK VPN router is likely trying to talk to the wrong IP address now. I would ask Romania to go to a site like http://checkip.dyndns.org and find out what they're WAN IP address is and make note of it. On your computer at UK, do an nslookup from the command prompt and look up Romania's dynamic DNS entry and see if the IP addresses match. If they don't, then you need to change your VPN settings on the UK router for the Romania VPN to this new IP address.

As for LAN-to-LAN VPNs in general, there's a fairly length set of requirements in each phase (commonly called phase 1 and phase 2) that has to do with encryption and authentication, but if your VPN tunnels were working before, and you can verify that none of that has changed, then I would guess that your problems lie with Romania's IP address changing and/or they've stopped updating their dynamic DNS service.

share|improve this answer
Thanks for detailed reply. It cleared lot of concepts. – goldenmean Oct 17 '11 at 11:55
Did what you said. Romania site did a check of their IP address and it is the same as what I have configured in my Draytek Router setting for Romania to UK dial-in VPN setting. So that does seem ok, isn't it. Do you think the port which that Romania-->UK VPN service is using (IPSec) could be blocked/disabled on UK(my ) side of network by the ISP? – goldenmean Oct 17 '11 at 12:09
Next step would be to turn on logging and check to see where it's failing. – gravyface Oct 17 '11 at 12:34
IS there any setting for 'Logging' in the draytek VPN setting or using some Networking/TCP-IP logging commands at Unix prompt from some LAN PC? If you have some time, please keep pointing me. – goldenmean Oct 17 '11 at 12:43
Strangely thing(well strange due to my ignorance may be!) i noticed when visit checkip.dyndns.org ,is that it gives me different ip address at different times:- One time it gave my my VPN router static ip address. When I checked recently, it gave a different IP address which when i checked, was the ip address of the Internet Service provider server. What is going on here? – goldenmean Oct 17 '11 at 12:48
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.