I am trying to set up a VPN using Windows Server 2012 Standard. My network has a SonicWALL edge router, and the server in question is a DC, running DNS, DHCP and RRAS, and the subnet is

I configured using the 'advanced' wizard, enabling both DirectAccess and VPN. Clients can now connect to the VPN. They receive an IP address from DHCP in the subnet and can then access the VPN server using either the PPP adaptor IP or the Ethernet adaptor IP on it.

However, if they try to ping anything else, one ping reply is received and the rest disappear. The VPN is successfully routing the client's packets to the destination host - I can see this in Wireshark - but only one reply actually goes to the client; the rest go to the server. Similarly, if I ping the client from an internal host, the first packet goes to the client, and the rest act as if it is addressing the VPN server itself.

It is clear that the VPN server is routing things sent from the client to the internal network, but is only routing one packet at a time from the internal network to the client.

I can't think of a reason that the behaviour would be different for the first packet than subsequent ones. Any advice would be appreciated.


I think I have found the answer, although if anyone could explain why it is this way I would be grateful.

I checked the Network Policy Service settings, and there were packet filters enabled for IPv4 to allow only "User's network". Removing this filter allows unrestricted connection.

I do not know why this causes the behaviour I saw, nor do I know why (if it does block VPN traffic) it is set by default... but I am glad the problem is fixed.


Think of NPS sort of like NAT. You would want to specify the servers that VPN traffic can get to.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.