Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up a VPN using Windows Server 2012 Standard. My network has a SonicWALL edge router, and the server in question is a DC, running DNS, DHCP and RRAS, and the subnet is

I configured using the 'advanced' wizard, enabling both DirectAccess and VPN. Clients can now connect to the VPN. They receive an IP address from DHCP in the subnet and can then access the VPN server using either the PPP adaptor IP or the Ethernet adaptor IP on it.

However, if they try to ping anything else, one ping reply is received and the rest disappear. The VPN is successfully routing the client's packets to the destination host - I can see this in Wireshark - but only one reply actually goes to the client; the rest go to the server. Similarly, if I ping the client from an internal host, the first packet goes to the client, and the rest act as if it is addressing the VPN server itself.

It is clear that the VPN server is routing things sent from the client to the internal network, but is only routing one packet at a time from the internal network to the client.

I can't think of a reason that the behaviour would be different for the first packet than subsequent ones. Any advice would be appreciated.

share|improve this question

I think I have found the answer, although if anyone could explain why it is this way I would be grateful.

I checked the Network Policy Service settings, and there were packet filters enabled for IPv4 to allow only "User's network". Removing this filter allows unrestricted connection.

I do not know why this causes the behaviour I saw, nor do I know why (if it does block VPN traffic) it is set by default... but I am glad the problem is fixed.

share|improve this answer

Think of NPS sort of like NAT. You would want to specify the servers that VPN traffic can get to.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.