I just configured a Windows VPN server, this service will have a large number of clients, probably more than the LAN itself, I am thinking of using a different subnet on the VPN IP Pool, but not quite sure how to route the VPN client subnet to the local LAN Subnet.

Any help is more than welcome.

Thanks in advance.


  • Updating this topic, I configured a static route on my gateway router pointing the VPNsubnet to the VPN Server IP....this was the obvious way to try first but, just my local LAN is able to see my VPN clients, but not the other way around.... from the VPN Client point of view, the trace stops at the VPNServer´s VPNsubnet IP... I am thinking a working (but probably not the best) scenario, where my VPN Server and VPN IP Pool belongs to a same subnet but different from my local LAN´s and put a router between those subnets with an old fashioned static route... I´open to new ideas... thanks. – D4. Oct 17 '09 at 17:14

I assume you're talking about hosting this VPN with Microsoft's Routing and Remote Access (RRAS) server.

I'll preface by saying that I've played with such a configuration but don't have any such configurations running in production.

You can assign a pool of IP addresses outside the subnet of the RRAS server to be given out to VPN clients. When I played with this in a lab scenario I found that the RRAS server (on W2K8 RTM, at least) would start doing crazy things like answering requests to its LAN interface with packets sourced by the RRAS interface (which isn't on the same subnet as the LAN interface). If you can get a route into the router acting as a default gateway for the VPN subnet then things should be fine.

Admittedly, it's a bit of a strange configuration. Generally, RRAS assigns IP addresses from the same subnet that the RRAS server is sitting in (typically via DHCP) and does proxy ARP "magic" to make those clients appear to be on the same layer 2 as the RRAS server's interface.

When you're mocking this up, throw a copy of "Network Monitor" or Wireshark onto the RRAS server and actually watch what's happening with the source addresses on packets. I think that'll give you a clear indication of where you need to put routes to get what you want to work.

  • Thank you, I´ll try what you suggested... but in any case, if this is not a good scenario in your opinion, what other solution would you recommend for VPN service authenticated with Active Directory? thanks in advance! – D4. Oct 17 '09 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.