I set up a VPN on Windows Server 2008 through its routing and remote access services. I connected to the VPN, and configured the client to allow for split tunneling (Internet traffic goes to my default gateway, and traffic directed to the VPN server goes through the VPN gateway).

I had to adjust the routing table, adding an entry to ensure traffic to my VPN server goes through the tunnel by running the command "route add [VPN.IP] mask [VPN.GATEWAY.IP] IF [VPN_INTERFACE_#]". Adding the correct route makes everything work flawlessly on all my machines, except for one.

The problematic machine is a laptop that's not directly connected to a network. It connects to WiFi, and then connects to a VPN to obtain internet access. Finally, it connects to the target VPN server for file sharing. The "route add" trick doesn't work for that laptop, I'm assuming because it's connected to two VPNs, and I'm getting the routing wrong. Can anyone familiar with routing explain what routes I may need to add?

  • Can you make a small diagram showing your setup?
    – Serhiy
    Sep 25 '12 at 19:43
  • Laptop connects to VPN1, so laptop has internet access. Browsers and everything function fine. Now I want to access a network share by connecting to a second VPN. Traffic to second VPN fails to route over 2nd VPN. I'm not sure what you mean by diagram... there's nothing to diagram, unless you want a pic of the output of my routing table from "route print".
    – Triynko
    Sep 25 '12 at 19:46

I got it. In additional to adding the route forcing VPN-targetted traffic through the VPN gateway, I then also needed to add a route to force VPN-gateway-targetted traffic through the wireless connection's VPN. Technically, the wireless VPN isn't a VPN, but it's still a gateway nonetheless, so it's the same as far as routing goes.

Step 1 (which I was already doing), was to route select traffic over the VPN:

"route add [VPN.IP] mask [VPN.GATEWAY] IF [VPN_INTERFACE_#]"

Step 2 (which I just figured out), was to ensure all the VPN traffic is routed through the secure wireless gateway. For some reason, when it's targetted at "In-Link" it doesn't work. So I ran:


Now I can access the file shares successfully on the laptop. I must understand the routing now pretty good, since I was able to figure out that second step no my own.


Take a peak at the VPN connection properties and see if Use Remote Gateway is checked; this will force the adapter to connect to the VPN for internet traffic. On the adapter where routing is not needed, make sure this is disabled/unchecked.

  • To access the Internet, well.. to access anything at all on the WiFi, all traffic MUST go through the first VPN. The 2nd VPN should NOT have all internet traffic go through it, but just the traffic specifically targetted at that VPN. "Use Remote Gateway" is not checked on the 2nd VPN, and shouldn't be, because normal Internet traffic should not go over that VPN. Leaving that option unchecked is what makes it a "split tunnel" as a I said. I added a route to make sure of that. The problem is that I need traffic to the 2nd VPN to go through the first VPN first to reach the internet.
    – Triynko
    Sep 25 '12 at 20:29
  • Basically, some traffic is selected to go through the 2nd VPN, and the 2nd VPN needs to route all it's traffic through the first VPN. This needs to be done completely on the client.
    – Triynko
    Sep 25 '12 at 20:32
  • So the 2nd VPN connects to a server that is not on the local network but rather on the internet somewhere? Make sure you can ping this second server
    – scape
    Sep 25 '12 at 20:32
  • Yes. The first VPN just gives the laptop Internet access, since it's secure WiFi at a college campus. The 2nd VPN connects to a server on the Internet at a different campus, allowing me to access file shares on that server. With the proper route in place on all wired clients, traffic directed at Internet-based VPN goes through that tunnel successfully. The problem is this laptop, because there's an extra VPN in there. I'm not sure how they interact, but basically, all traffic needs to go through VPN 1 to reach the outside world, so all traffic to VPN2 needs to go through VPN1.
    – Triynko
    Sep 25 '12 at 20:35
  • Once VPN1 is connected, can you ping the VPN2 server?
    – scape
    Sep 25 '12 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.