13

I connect to a server on my local network via Remote Desktop. I then need to make a VPN connection out to the internet from within that Remote Desktop session. However that immediately disconnects my remote desktop session.

What's happening here and is there a way I can fix it?

Extra Information:

Local Computer #1:

  • Initiates RDP Session to #2
  • Windows 7
  • 10.1.1.140/24

Local Computer #2:

  • Windows Vista
  • 10.1.1.132/24
  • Initiates VPN connection to public IP
  • VPN is PPTP
  • Set to obtain IP and DNS automatically
  • 'Use Default Gateway on Remote network' is unselected
  • 'Enable LMHosts' is selected
  • 'Enable Netbios' over TCP/IP is selected
  • Has the ability to be multi-homed (ie. has 2 nic's)

Public facing ADSL Router:

  • VPN Server
  • receives connection from #2 via external IP
  • Internal network is 192.168.0.0/24

I can make a VPN connection from my PC with no problems (no RDP involved).

Tom suggested using dual NIC's in a comment below. I have dual NIC's in the box (#2 above) but I'm not sure how to set them up properly, or how to assign the VPN to use one over the other.

I tried setting the extra NIC to be on the same private network (10.1.1.200/24), starting the VPN and then trying to RDP to either of the NIC's, 10.1.1.132 or 10.1.1.200 but didn't have any luck. Is there some way I can tell the VPN to use one NIC over the other?

As requested - here are my routing tables from PC#2:

Before VPN is connected:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.254       10.1.1.132     20
         10.1.1.0    255.255.255.0         On-link        10.1.1.132    276
       10.1.1.132  255.255.255.255         On-link        10.1.1.132    276
       10.1.1.255  255.255.255.255         On-link        10.1.1.132    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link        10.1.1.132    296
  169.254.255.255  255.255.255.255         On-link        10.1.1.132    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.1.1.132    276
===========================================================================

and after VPN is connected:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.254       10.1.1.132     20
         10.1.1.0    255.255.255.0         On-link        10.1.1.132    276
       10.1.1.132  255.255.255.255         On-link        10.1.1.132    276
       10.1.1.255  255.255.255.255         On-link        10.1.1.132    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link        10.1.1.132    296
  169.254.255.255  255.255.255.255         On-link        10.1.1.132    276
      192.168.0.0    255.255.255.0    192.168.0.254    192.168.0.234    267
    192.168.0.234  255.255.255.255         On-link     192.168.0.234    522
    remote-vpn-ip  255.255.255.255       10.1.1.254       10.1.1.132     21
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link     192.168.0.234    522
===========================================================================

I even tried hooking up the second interface (10.1.1.232) and playing with the default routes:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.254       10.1.1.132     21
         10.1.1.0    255.255.255.0       10.1.1.254       10.1.1.232     11
       10.1.1.132  255.255.255.255         On-link        10.1.1.132    276
       10.1.1.232  255.255.255.255         On-link        10.1.1.232    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link        10.1.1.132    296
  169.254.255.255  255.255.255.255         On-link        10.1.1.132    276
      192.168.0.0    255.255.255.0    192.168.0.254    192.168.0.235    267
    192.168.0.235  255.255.255.255         On-link     192.168.0.235    522
    remote-vpn-ip  255.255.255.255       10.1.1.254       10.1.1.132     21
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.1.1.132    276
        224.0.0.0        240.0.0.0         On-link        10.1.1.232    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.1.1.132    276
  255.255.255.255  255.255.255.255         On-link        10.1.1.232    266
  255.255.255.255  255.255.255.255         On-link     192.168.0.235    522
  • Please provide some more information on your setup. In particular, what VPN technology (IPsec, SSL VPN,...), what VPN client, and what kind of routing in the LAN? – sleske Oct 21 '10 at 8:48
  • Do you have the vpn setup to not route all traffic over the vpn ? if its setup like that, it'll cut you off. – Sirex Oct 21 '10 at 9:56
  • I've added more information. Also - I've tried having 'Use default gateway on remote network' both selected and unselected. No luck. Thanks for your input so far. – Dan Oct 21 '10 at 22:41
  • Does all traffic from other hosts on the 10.1.1.0/24 network get rejected by PC#2 when the VPN is active? ICMP (Ping) etc.? – Goyuix Nov 2 '10 at 23:01
  • Yes Goyuix - that's correct. Pings to PC#2 are only successful when the VPN is inactive. – Dan Nov 4 '10 at 22:46

11 Answers 11

10

What's happening is that you're effectively cutting off the IP route from the server to yourself - hence the RDP session loss. You can fix it by setting up the VPN in a way that it's bound to a second interface (physical or virtual) so that both the VPN and RDP link can coexist. How you do this depends enormously on a range of very detailed configurations that we don't know right now, so if you want help with this you'll have to come back to us with a LOT more information, just as much as you can please.

  • 3
    +1. That would be my guess as well. I wonder if something like LogMeIn might be an easier solution than trying to figure out a workaround for getting the RDP session to work. – joeqwerty Oct 21 '10 at 11:42
  • Put a second NIC in the box, and have the VPN client originate from the one with the default route assigned. – SpacemanSpiff Oct 29 '10 at 14:28
  • You might be on to something here Tom. See edit in question. – Dan Nov 2 '10 at 22:58
  • How would that happen, if the remote gateway setting is disabled and he is connecting over the local route (same subnet)? – Joris Nov 3 '10 at 7:52
5
+25

This can be usual practice - by default, on a windows box, (this may have changed), all traffic gets forced down the VPN tunnel, so yes, your RDP will drop.

I suggest, going to the advances settings of your VPN on your server, and making sure it doesn't send all traffic via the VPN.

Also, check that the destination network doesn't use the same subnet settings as you do, otherwise again, you'll experience the symptoms you describe.

  • Just to check, your actually physically sitting at local computer #1, right? – Mister IT Guru Oct 29 '10 at 13:39
  • Yeah - that's right. I tried setting 'Use Default Gateway on Remote network' as unselected. No luck. – Dan Nov 2 '10 at 22:33
  • Also - it is a different subnet, – Dan Nov 2 '10 at 22:33
1

I had the identical problem. Check to see if the vpn provider can add you to a group that has a policy set for 'split tunneling' - this is done on the vpn host side and if the server does not have this enabled you will not be able to do what you are trying to.

Seeing that your vpn has the address 192.* when you connect it will destroy the interface you are connecting on (thus cutting you off).

If split tunneling is not enabled on the VPN server (contact the VPN server admin about this!) you will not be able to connect.

This all assumes that you are setting your local vpn connections correctly (it looks like it).

  • Thanks - I can't see any option for 'Split Tunneling' on the VPN server. To be clear - I am just using a ADSL router (Draytek) with VPN server functionality built in. It may not have some advanced options... – Dan Nov 2 '10 at 22:35
  • Does this router have a pptp daemon running? If it does you'll need to turn it off. It could be interfering with the GRE packets. – Mister IT Guru Nov 6 '10 at 22:16
1

I had this problem before, and the solution is "split tunneling", this means, send the Internet Traffic to the default gateway, and the traffic to the VPN network using the Tunnel.

What you have to do is set up a static route to your machine in Computer #2. And setting the priority for this route to 0

So the end result will be a default route 0.0.0.0/0 to the IP address of the VPN Gateway, and a static route to your machine using the default gateway.

In windows what you would do is something like this:

 route add 10.1.1.140 netmask 255.255.255.255 <defaultGW> -P

where defaultGW is the ip address of your router.

This will ensure that traffic going to 10.1.1.140 will not be routed to the tunnel.

if you have physical access to computer #2, connect to the VPN and let us know the routing table of the machine:

route print

one before connecting to the vpn and one after.

Whit this information, we can help you up setting the "split tunnel"

Hope to be of assistance

  • I added routing tables to the question above. Thanks for your input. – Dan Nov 5 '10 at 0:11
  • When you connect to the VPN on PC#2, can u still surf the WEB? and if you can, can you check that you are goin out whit the same Public IP? whatismyip.net should give you the IP address you are using to go out to the World. another Question, are you using the windows dialup interface to connect to the VPN or some other VPN client? – Hugo Garcia Nov 5 '10 at 14:33
1

I have found that using the IPv6 address to connect does not result in the VPN breaking the RDP session.

In my setup I have a windows virtualbox guest and host and my VPN on the guest forces ALL traffic via the VPN (this is server configured I cannot change this)

If I connect from my host to the guest via the ipv4 address (e.g. 192.168.1.x) then as soon as i initiate the VPN connection on the guest the RDP session breaks. However if i connect RDP via the guest host name (which resolves to the IPv6 address) then the VPN connection does not break the RDP session.

0

Hard to tell without more information, but many VPN clients have the nasty habit of (logically) deconnecting their host computer from the LAN while setting up the VPN connection. I.e., you can be connected either to your LAN, or to the VPN, but not both.

If your VPN client does this, obviously your RDP session would be killed as a side effect of cutting you off from the LAN.

I'm not sure why VPN clients do this, whether it's an intentional measure (security?) or just a side effect of reconfiguring the network, but I have often encountered it.

Check the manual for details, and for how to fix this.

  • 1
    VPN clients do this to prevent people linking together two networks, (using routing) and stealing all your data from your exposed systems, (or even just being compromised with malware)an attack of this manner will look to originate from system doing the linking, leaving pretty much no evidence – Mister IT Guru Oct 29 '10 at 13:38
0

Normally I've used "nested" RDP sessions via VPN with no special problem ( apart a slighty slowering ) The underlying schema was Client->VPN->RDP First Server-> Internet->RDP Second Server. The only problem you could have, I think, is that First server can have a firewall which blocks the outgoing call of RDP Protocol. Using a VPN you can "get in" server network but this is not a warranty that same server or other LAN machines can establish an RDP Session with an external LAN server. If your second server is in the LAN of the first, please check that it can be reached by a RDP Session ( eg: can have a local firewall blocking RDP port ) and Windows allow to use it.The immediate cut off of second RDP session means that there is a network "problem" ( firewalls, auth and so on ) on the route to second server so an accurate check of outbond calls from first server is required. According to me the solution is more simple than you think also if first server have only one network card. For long time I have operated with nested rdp sessions with servers mounting Windows 2000, Windows 2003 and 2008 using a VPN server on Windows 2003 server then nesting RDP sessions for the other two, sometimes toghter, from the first one. So please check network conditions of first server.

0

You mentioned that "Use default gateway" is unchecked - which if that is acceptable (no routing required outside the 192.168.0.0/24 subnet) should have solved your problem.

What you are left with sounds like potentially the firewall getting in the way? Can you completely disable the Windows Firewall (or whatever product you are using) and verify the symptom still exists?

Are you able to reconnect the dropped session after the VPN link has been established, and remains active?

  • I've tried with all firewalls turned off and I can't reconnect the RDP while the VPN is active. – Dan Nov 2 '10 at 22:37
0

Edit: I missed sleskes' answer explaining the same.

Perhaps some installed security product (firewall, "internet security", antivirus, ...) detects the PPTP connection and has the same functionality?

Note that some of these products have options that are buried deeply in the GUI behind unassuming checkboxes.

0

Its likely that the VPN client is configured to route ALL traffic down the tunnel, not just traffic to the networks that the VPN routes to. This drops any currently open connections and changes the routing behaviour on the server, hence why your connection is dropped.

0

This doesn't solve the specific problem mentioned but this is what I used to solve the same type of problem in supporting a variety of customers using a variety of vpn clients that are not all compatible and some that create a closed tunnel vpn connection. I have a vmware server that host several virtual machines and use the vSphere client to connect to the windows session and I can open a closed tunnel vpn connection out and not lose access to the windows session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.