Let's suppose we have this configuration:


When I setup my VPN role in the Windows Server to allocate IPs to VPN clients from the range to everything works fine.

However, when I want to isolate the VPN clients in a different subnet (for example then I don't know how to proceed. The connection to the VPN server works fine, my VPN client gets the address for example, and is able to ping the server at, but can't see the other machines in and can't reach the Internet though.

I know that I have to add some static route somewhere, but I don't really see where. Any pointer?

  • Share your configuration. What is the purpose for this isolation, if they should still see each other with supposedly unlimited connectivity? – Esa Jokinen Jun 5 '17 at 13:43
  • I want the VPN clients in the subnet be able to access internet through the server's connection, but not to be able to "see" the network in the subnet (which consists of several servers and printers that the VPN clients don't need any access to). – infotic Jun 5 '17 at 14:32

You are missing the route in your router for You VPN clients can get to your local LAN. The clients would be responding to their default gateway, since they do not know where is. That would need to be in your router's routing table, so that it can forward that traffic back to your Windows VPN server.

As a general rule, every router needs to have a route added for any subnet that is not directly connected.

  • I added a route in my router from to the server and now it works perfectly, thank you! However now the VPN clients in the are able to see and ping the whole network, I want them to be able only to access Internet through and not see my web server for example at (or any other machine in this subnet). How can this be done? – infotic Jun 5 '17 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.