We did set up a Windows Server 2019 as a VPN-Server that should grant access to a /22-network.. It has a single Ethernet-connection to the network (spanning up to The server's IP is and the RAS-connection has

But when opening the VPN-connection (split-tunneling enabled), I can only reach everything in The remainder of the network is not reachable.

What do I need to change on the RAS-Server in order to reach the entire network?

The issue seems to be the routing-table ( is the remote computer's gateway):

route print -4

Network destination       Netmask        Interface          Gateway Metric
       25     26

Requests to are thus routed to the local gateway instead of

The powershell confirms this:

Find-NetRoute -RemoteIPAddress ""
NextHop : (good!)

Find-NetRoute -RemoteIPAddress ""
NextHop : (wrong!)

I can edit the routing-table manually of course:

route add MASK METRIC 26

The whole target-network is reachable after that. But surely, it cannot be the solution to edit the routing-table on each client.

What do I need to change on the server-side in order to get this to work automatically?

Thank you very much!

Edit: As requested a screenshot of the configuration of the static route that I tried. enter image description here


From the output you have provided, the subnet mask for VPN client is /24. This will only allow it to access There are few possible solutions.

  1. Fix the subnet mask, for example, if you hare using DHCP to assign IP address, update the subnet mask to

  2. Add routes in the RRAS console, IP routing, Static Routes, Add new static routes for remaining networks, like and point them the IP Address of server's NIC which is connected to LAN.

| improve this answer | |
  • I tried option 2: a static route as described. But the route does not appear in the routing-table (route print -4) and a ping does not work. – Andreas Mar 24 at 9:22
  • Can you share the screen for RRAS where you entered Routes? – Abu Zaid Mar 24 at 19:14
  • I added a screenshot in the post above (including the output of ipconfig /all). – Andreas Mar 25 at 11:20
  • Solved it: The static routes in the RRAS-console are not meant for the client, but for the server itself. In order to communicate routes to the client, the DHCP-Relay on the RRAS-Server needs to be configured and on the DHCP, you can use the option 121 to communicate static routes. These are then used by the RRAS-clients. And using a DHCP-policy it is possible to communicate these routes only to VPN-Clients (I only read about that yet and did not actually do it). Thank you for your support! – Andreas Mar 27 at 9:09
  • OK, let me know if it works. I didn't have a Lab to test it, but I know that there is a way to send static routes. DHCP option 121 should work, but I have never done it myself. If all fails, I would say use a DHCP server to correct the subnet mask. – Abu Zaid Mar 27 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.