This should be a relatively straightforward RRAS VPN setup, but I'm not getting the behavior I want.

I have two subnets, a Prod Server subnet and a Client subnet. Both are publicly routable. I have created a VPN server (Win 2008R2) with a NIC in both subnets. DHCP is running on a single server in the Server subnet, and clients get their requests forwarded to the server via an IP-Helper configured on the router.

What I would like is for VPN clients to connect to the VPN server using the interface in the Server subnet (where I can more easily manage the firewall rules), but then get IP addresses in the client subnet via DHCP. Is this even possible? I can't seem to figure out how to tell RRAS which interface to use to get its block of 10 DHCP IP addresses.

I can put the public VPN IP in the client subnet if that's required, and have in fact tried that. I've tried both with and without DHCP Relay Agents configured in RRAS.

I always get one of three results:

  1. No connection to the VPN -- "Error in assigning inner IP address to initiator in tunnel mode."
  2. Client connects and gets APIPA address (169.254.x.x)
  3. Client connects and successfully gets IP address from DHCP -- from the SERVER subnet.

Is there any way to do this with actual DHCP? Or must I use the "static address pool" option instead?


Well, I can't explain exactly what was wrong, but I reconfigured RRAS as a VPN server, using the 'client' interface as the RRAS 'external' interface, and now VPN clients are getting DHCP addresses in the client subnet.

I had to add a static route on the client interface for all traffic destined for the server subnet to go through the default gateway on the client subnet to get full network connectivity for the clients, but that's all it took -- the client got its IP address and DNS servers from the VPN server's client interface.

I can't explain the strange behavior I was experiencing with my earlier attempts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.