I've setup site to site VPN using RRAS services on Windows Server 2012 R2. Let's call this computer RRAS machine. RRAS machine has two network adapters. One is a private one (192.168.200.x) and other is the accessible from Internet but it is firewalled. Our network admin opened all the necessary ports and it works as Azure VPN gateway connects.

My on premises address space is correctly set and I can see it being routed when I do tracert from VM machines.

Gateway connects and I can see traffic between sites. From on premises RRAS machine I can access VMs without problems which initialized the VPN connection (and where RRAS is installed). I can ping and use RDP directly without any kind of problems.

What I can do from VM machines (connected to virtual network over VPN) is to access RRAS machine's other network adapter (which happen to be but I can't access any other machines on 192.168.200.x network. It looks like the packets are not being routed.

So to recap. The problem I have is that I can't access other on premises computers but only one network adapter attached to RRAS machine.

What can I do to fix this? Does anyone have experience with setting up this kind of network?


The reason is that packets are properly routed to the on premises machines, but those same machines do not know where to send their answers back to Azure clients.

Correct, yes. But that does not mean you have to configure the route on every machine. I just had the exact same issue and I solved it like this:


1 Azure Subscription with 1 VNet with 1 Dynamic VPN Gateway.

1 RRAS Server on Premise behind my Router, routing the IPSEC Ports to the RRAS Server (I know, bad setup, NOT supported by Microsoft, but still works if you do the correct port forwarding).

All Default Gateways on all on Premise Machines are set to the Router, not the RRAS Server.

Situation: Exactly the same as you. VPN is set up and connected. Connecting to the Azure Machines from the RRAS Server works, connecting to the RRAS IP's from the Azure Machines works too. What doesn't work is connecting to the Azure Machines from another on Premise Machine and connecting to another on Premise Machine from Azure Machines.

Resolution: As you stated yourself, the on Premise Machines don't know how to connect to the Azure subnet. But instead of configuring this static route on all the on Premise Machines, I created just 1 static route on my Router, pointing the Azure Subnet to my RRAS Server. Magic Magic, all connections from all Machines on Premise to Azure and vice versa started working like a charm.

Of course, the smoothest solution would be to use your default gateway router to connect to the Azure network as this would solve the "my normal default gateway doesn't know of azure" problem.


I've found out what was the problem. I've set the static routes properly on the VPN server, but what I didn't realize is that I also have to set static routes on all the on premises machines which VPN Azure clients try to reach.

The reason is that packets are properly routed to the on premises machines, but those same machines do not know where to send their answers back to Azure clients.

This is the example route I had to set set on all on premises machines:

route -p ADD MASK [vpnserverIP] METRIC 100

Where is my Azure Virtual Network and

[vpnserverIP] is the IP address of the VPN server and in this case the gateway for all on premises machines.


What you should do is actually add this as a static route on your gateway instead of configuring it at each servers.

  • 1
    Could you add more details? Answer this short would be better as comment. – Esa Jokinen Apr 14 '15 at 6:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.