Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create a simple VPN hub-and-spoke topography. I have managed to get quite a long way and I hope the following diagram describes what I have been able to build thus far:

VPN topography

As you can see, the hub is a Windows Server 2008 R2 box running RRAS. The spokes with either be Dreytek routers with a number of PCs (or other devices) on the LAN behind them or PCs dialling in directly to the server. All of this works as expected except for the fact that none of the LAN devices at the spokes are able to communicate with the devices at the other spokes. For example, the direct dial-in PC ( cannot communicate with or

Things that I have tried and work:

  • All of the LAN devices can ping any of VPN addresses (so, for example, the direct dial-in PC can ping, and
  • I have enabled Syslog on the Draytek routers and can see the ICMP traffic through the firewall when the 10.0.0.x address of the router is pinged (for example, if I ping from the direct dial-in PC, I can see the firewall allowing the ping).
  • I have added static routes to the Dreytek routers (for example, on the router, I have added a route for / 24 and / 24 routing via
  • I have added static routes to the direct dial-in PC for / 24 via and / 24 via
  • I have added static routes to the server for each LAN at the end of the spokes (for example, I added a route for / 24 to route via, and / 24 via I am having trouble persisting these routes so that they re-establish if the VPN connection drops and re-connects.

Things that don't work:

  • The server is unable to ping any of the LAN PCs (for example, it can't ping or .2 etc.). Syslog on the routers does not see any ICMP traffic.
  • The client PCs are unable to ping any remote PCs (for example, 192.168.10.x PCs cannot ping 192.168.3.x PCs or the direct dial-in client at

If a use tracert or pathping, it does look like the traffic is trying to go via the server but it never gets there. For example:

C:\Users\Administrator>pathping -n

Tracing route to over a maximum of 30 hops

  2     *        *        *

I am really at a loss as to what to do next. It must be possible to get this working... I have found so many articles about this topic but nothing seems to address this particular problem. So I guess my two main questions are:

  • What am I missing to get the remote LAN PCs to be able to communicate with each other?
  • What do I need to do to persist the routes via the VPN clients to their LANs?
  • Can I avoid static routes completely and use dynamic routes? I have tried using RIP but the RIP multicasts come in over the VPN (I have seen this using Wireshark) and I can't create RIP on the "Internal Interface".

One idea that I've had... Could the problem be anything to do with IPv6? When I was experimenting, I tried disabling it using Microsoft Fixit 50409. After I did this, neither the routers nor the direct dial-in W7 client were able to establish a VPN connection until I re-enable it... I had assumed that all traffic would be IPv4 but perhaps I'm wrong?

Many thanks!

Edit: In response to Stephane's comment, here are the routing tables for the various components in the network...


C:\Users\Administrator>route print -4
Interface List
 18...........................RAS (Dial In) Interface
 11...00 15 5d 2f 4d 2d ......Microsoft Virtual Machine Bus Network Adapter
  1...........................Software Loopback Interface 1

IPv4 Route Table
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
      6         On-link    276     21     21     21         On-link    261         On-link    261         On-link    261         On-link    306         On-link    306         On-link    306     21     21     21         On-link    306         On-link    261         On-link    276         On-link    306         On-link    261         On-link    276
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric

Note: One of the problems I have is that I have to manually add the routes for, and every time the VPN clients connect. This is clearly a serious problem as I have to be able to persist these routes, but maybe it's not possible?

Windows 7 Client:

C:\Windows\system32>route print -4
Interface List
 26...........................CodeArt Consulting VPN
 17...90 b1 1c 67 94 d4 ......Realtek PCIe GBE Family Controller
 13...68 94 23 36 83 ba ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3

IPv4 Route Table
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
     10     11         On-link    266     11         On-link    306         On-link    306         On-link    306         On-link    266         On-link    266         On-link    266     11     11         On-link    306         On-link    266         On-link    266         On-link    306         On-link    266         On-link    266
Persistent Routes:

Note: I have added the routers to and manually.

Router /

Key: C - connected, S - static, R - RIP, * - default, ~ - private
*            via      WAN2
C   directly connected   VPN-1
S     via         VPN-1
C~    directly connected    LAN 
S    via         VPN-1
S    via         VPN-1
S  via      WAN2

Note: The static routes to and have been added to the router and are persisted as expected.

As far as I can tell, all of the routes are in place correctly but of course, there may be a mistake or something is missing...

share|improve this question
Could you please clarify your network topology ? Specifically, it would make things much more clear if you could describe things in terms of network segment and add network ask to all IP addresses/segments. I'm asking because I suspect you have a simple routing issue but I can't figure out exactly what your topology and routing table is for each device. – Stephane Apr 15 '13 at 8:37
Hi Stephan. Thank you for your comment. I have added the routing tables as requested and I hope that you can shed some light on the problem for me. Many thanks, Ben. – Ben Abbott Apr 15 '13 at 9:10
up vote 0 down vote accepted

I have been able to resolve this issue.

The problem was that I had configured the router to use NAT for the VPN connection. Changing it to routed complete fixed the problem, as all of the routing information was correct. The devices on the LANs at each spoke can now communicate with each other.



share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.