0

Statement of problem

Although all VMs and dialup clients served by RRAS can reach what they need to reach, the RRAS machine itself cannot reach the Internet.

Scenario

A physical HyperV machine (SGHYPERV) and a physical file server (SGFILE1) are behind a firewall, connected to the Internet.

On the HyperV machine, two subnets are defined completely internally, each containing several VMs. In addition there are several VMs that share the same subnet as the physical machines. So three virtual switches, one of which is shared with the physical network. A machine running RRAS routes among these subnets -- and also provides dialup VPN access.

The firewall provides NAT; RRAS just routes addresses in clear.

No machines have Windows Firewall enabled whatsoever.

Network sketch:

network sketch

What works:

  • The physical machines can reach the internet, and all VMs including the RRAS machine.
  • The VMs can reach the internet, and all other VMs including the RRAS machine, and the physical machines.
  • VPN clients can reach all VMs including the RRAS machine, and the physical machines.
  • The RRAS machine itself can reach all VMs and the physical machine SGFILE1.

("reach" means both ICMP Ping, and also TCP services such as RDP, SMB, http, etc.)

What doesn't work

  • The RRAS machine itself cannot reach the Internet.
  • The RRAS machine itself cannot reach the physical SGHYPERV, though SGHYPERV can reach the RRAS machine fine.

Routing table from the RRAS machine

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.6.42.68       10.6.42.71    261
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     172.19.101.0    255.255.255.0         On-link      172.19.101.1    261
     172.19.101.1  255.255.255.255         On-link      172.19.101.1    261
   172.19.101.201  255.255.255.255         On-link    172.19.101.201    270
   172.19.101.202  255.255.255.255   172.19.101.202   172.19.101.201     15
   172.19.101.203  255.255.255.255   172.19.101.203   172.19.101.201     15
   172.19.101.204  255.255.255.255   172.19.101.204   172.19.101.201     15
   172.19.101.205  255.255.255.255   172.19.101.205   172.19.101.201     15
   172.19.101.206  255.255.255.255   172.19.101.206   172.19.101.201     15
   172.19.101.207  255.255.255.255   172.19.101.207   172.19.101.201     15
   172.19.101.208  255.255.255.255   172.19.101.208   172.19.101.201     15
   172.19.101.209  255.255.255.255   172.19.101.209   172.19.101.201     15
   172.19.101.210  255.255.255.255   172.19.101.210   172.19.101.201     15
   172.19.101.255  255.255.255.255         On-link      172.19.101.1    261
     172.19.102.0    255.255.255.0         On-link      172.19.102.1    261
     172.19.102.1  255.255.255.255         On-link      172.19.102.1    261
   172.19.102.100  255.255.255.255         On-link      172.19.102.1    261
   172.19.102.255  255.255.255.255         On-link      172.19.102.1    261
       10.6.42.64  255.255.255.224         On-link        10.6.42.71    261
       10.6.42.71  255.255.255.255         On-link        10.6.42.71    261
       10.6.42.75  255.255.255.255         On-link        10.6.42.71      6
       10.6.42.75  255.255.255.255       10.6.42.75     172.19.102.1    261
       10.6.42.75  255.255.255.255       10.6.42.75     172.19.101.1    261
       10.6.42.77  255.255.255.255         On-link        10.6.42.71    261
       10.6.42.95  255.255.255.255         On-link        10.6.42.71    261
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.6.42.71    261
        224.0.0.0        240.0.0.0         On-link      172.19.102.1    261
        224.0.0.0        240.0.0.0         On-link      172.19.101.1    261
        224.0.0.0        240.0.0.0         On-link    172.19.101.201    270
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.6.42.71    261
  255.255.255.255  255.255.255.255         On-link      172.19.102.1    261
  255.255.255.255  255.255.255.255         On-link      172.19.101.1    261
  255.255.255.255  255.255.255.255         On-link    172.19.101.201    270
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
       10.6.42.75  255.255.255.255       10.6.42.71       1
          0.0.0.0          0.0.0.0       10.6.42.68  Default 
===========================================================================

Traceroutes (using WinMTR)

to default gateway (10.6.42.68)

|------------------------------------------------------------------------------------------|
|                                      WinMTR statistics                                   |
|                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
|------------------------------------------------|------|------|------|------|------|------|
|                              10.6.42.68 -    0 |   21 |   21 |    0 |    0 |    1 |    0 |
|________________________________________________|______|______|______|______|______|______|

   WinMTR v0.92 GPL V2 by Appnor MSP - Fully Managed Hosting & Cloud Provider

to Google 8.8.8.8

|------------------------------------------------------------------------------------------|
|                                      WinMTR statistics                                   |
|                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
|------------------------------------------------|------|------|------|------|------|------|
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |    7 |    0 |    0 |    0 |    0 |    0 |
|________________________________________________|______|______|______|______|______|______|
   WinMTR v0.92 GPL V2 by Appnor MSP - Fully Managed Hosting & Cloud Provider
8
  • The RRAS server has 10.6.42.68 as it's Default Gateway. Is that the correct ip address of your router/firewall? – joeqwerty Jan 26 '18 at 16:52
  • @joeqwerty - Yes, it is. – Ross Presser Jan 26 '18 at 16:59
  • What does a tracert from the RRAS server to the DG show? How about a tracert to 8.8.8.8? – joeqwerty Jan 26 '18 at 16:59
  • Former works; latter fails with nothing reached. added WINMTR traces to question. – Ross Presser Jan 26 '18 at 17:10
  • Found one exception to the "everything works" thing -- SGVPN cannot reach SGHYPERV (ping gives request timed out). SGHYPERV can reach SGVPN, however. – Ross Presser Jan 26 '18 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.