Yes, solicited traffic is traffic that was initiated by you. Solicited traffic automatically gets a pass, no matter the port, because you initiated it. This alleviates a lot of the headaches of traditional firewalls, e.g., having to open up ALL the ephemeral ports, because Windows Firewall will keep track of the session state for you.
1. Check L2TP ports existence
First check whether there are actually L2TP port configured in Routing and Remote Access (RRAS).
Click Start, click Administrative Tools, and then click Routing and Remote Access.
Expand your server, and then expand ports.
In case there are no entries for WAN Miniport (L2TP)..., add them by right clicking ports.
2. Check RAS ...
If you look at the route table with route print does it show things correctly when you have the /23 route? Does a traceroute show the traffic trying to leave the correct interface?
Some times what you see in the Windows GUI does not reflect what Windows is actually doing. I find that it is always best to double check from the command line.
Locked the keys in the car, eh?
I don't believe that one is configurable via Group Policy. Periodic policy refresh isn't going to help you run a script or install software on the machine since both of those operations only occur on a synchronous policy refresh (i.e. a reboot).
I think you're going to be stuck laying hands on the machine.
I've forgotten ...
So I've managed to figure this out after a lot of digging around, I am able to use the native Azure Site-to-Site VPN functionality with OpenSwan which runs on a linux box (Raspberry Pi/Arch Linux) behind my home network's NAT router.
192.168.0.0/24 - Home network
192.168.1.0/24 - Azure network
192.168.0.1 - Home router's private IP
There is no way to push routes from a PPTP server. The connection is established and configured using IPCP, the PPP Internet Protocol Control Protocol defined in RFC 1332. In fact, its very name ("Point to Point") implies that you won't find any support for routing.
Which routes are available depend entirely on the client-side configuration. There are three ...
Performance for any VPN solution is typically limited by the available bandwidth between the clients and the termination point. Unless you have an extraordinarily large pipe and a significant amount of remote users (thousands), it's not going to make a difference. And if you do have that volume, you should look at load-balanced VPN concentrators rather than ...
The domain controller certificate had expired.
That prevented connections that required the Protected EAP authentication method. Re-issuing the domain controller certificate immediately allowed RADIUS requests to authenticate normally.
If your proxy can also route traffic, you can just configure RRAS to route all traffic from the NAT interface to the proxy. If your proxy does not route, then you should use something like GPO to enforce proxy settings on browsers inside of your network and block outbound traffic that does not go through the proxy at your firewall.
Yes System 256 2001:470:xxxx:yyyy::/64 13 Internet
Yes Manual 256 2001:470:xxxx:yyyy::/64 21 RAS (Dial In) Interface
Your Internet subnet and RAS subnet need to be different subnets. Pick one, assign it to your RAS subnet and ensure your IPv6 gateway knows to route that subnet to your RRAS server.
You also need to confiugre the route back to the internal network.
On your default gateway (192.168.100.1), there is probably a default gateway to the outside world. This gateway also knows the 192.168.100.0/24 network, as it is directly connected.
It does not know the internal 192.168.200.0/24 network, and will use the default route to reach that.
I found them at c:\Windows\System32\LogFiles - The RRAS logs are in form INI####.
Also of note, you need to have logging turned on for RRAS if you want this to work properly. Directions on how to do so are over here: http://technet.microsoft.com/en-us/library/ee922651(v=ws.10).aspx
The do-nothing properties button on the ipv4 protocol is a ubiquitous problem in Windows 10. The problem has been widely reported long ago (before Windows 10 was even released) so do not expect a fix anytime soon. (Update: This is fixed in Win10TH2)
The only way I could manually set the DNS settings was to modify the rasphone.pbk file in C:\Users\...
In general, this article is pretty similar to your problem.
Strongswan (IKEv2) connection established, but no traffic routing
I guess this might help you also.
$ iptables -t nat -A POSTROUTING -o eth0 ! -p esp -j SNAT --to-source "your VPN host IP"
Finally found the correct steps on how to create a VPN on Windows Server 2016 in AWS. Once connected, the client is able to access resources within the VPC and still access the Internet. Here's the complete list of steps on how it was done for those interested.
Setup the instance and needed interfaces:
Spin up a Windows Server 2016 instance in EC2 with 1 ...
This appears to be a terrible architecture overall but if you insist on doing this you just need to install some form of proxy on server A then point to it from your applications on server B - that or design it right of course.
IAS Log Viewer works well for IAS (including RADIUS) and RRAS. There is a portable version with no install as well as installable.
It is shareware -- and can be used for free (as in beer). If you like it, pay the developers to register it and unlock additional goodies.
You shouldn't need to configure the DHCP relay agent on the RRAS server as the DHCP server on the router is on the same subnet (or should be) as the RRAS server. A DHCP relay agent is only needed when you need DHCP packets to transit a router from one subnet to another subnet. Try again with the DHCP relay agent disabled.
At the very worst you can use a ...
This is how Windows unfortunately now handles routes when given an IP via PPP. It decides to put a route in by its self and guess the subnet mask based on the old clasful system. Terrible pain the rear this is.
I had success adding a route after connection, where 192.168.10.0 is the machine I'm trying to connect to, and 255.255.255.0 is the submask of the network:
route add -net 192.168.10.0 netmask 255.255.255.0 dev ppp0
See PPTP Client Routing for more details - you can also add scripts to /etc/ppp/ip-up.d/ to set up routes automatically on connection, detailed ...
I had this problem so I'll go ahead and tell you what it was for me. My password (given to us by our host had a $ in it). I was copy-pasting the password from an rdp shell script that had escaped the $ with a \. I was mentally forgetting the reason for \ and thinking it was literal. I spent hours working on authentication when in reality, I need only remove ...
I too found (following Dan's answer - +1) that restrictive filters were added when I installed RRAS on my new Windows Server 2008 R2 machine.
Looking at the same thing on Windows Server 2003, no such filters were added by default.
To restore the ability to ping the machine (or RDP in, or pretty much anything else) I first just unticked Enable IP Router ...
The SSTP VPN service is always associated with a HTTPS web listener; you can change the certificate it uses in its properties.
If you have lots of listeners around and/or don't know what listener the VPN service is using, you can check that in the VPN properties, in the "Protocols" tab.
For L2TP/IPSEC, there is no option in the TMG (or ISA) ...
The reason you don't see the same options as in the guide, is because the guide applies to Windows Server 2008 R2, while you use Windows Server 2008 with SP2. They are 2 distinct operating systems.
For information on setting up VPN on Windows Server 2008, check out the deployment guides at TechNet
The password is stored in an encrypted form that's next to impossible to manually decrypt. PSK VPN connections really weren't meant for your use case, Certificate based authentication was, which is why you're finding it hard to do what you want.
(This is KCotreau's original answer, but he included it in the question. Re-posting as an actual answer)
Cause: There are two basic causes for this error.
An incorrect key in the registry if you are running IPv6.
This has happened to me on a couple of Dell Windows 2003 R2 64-bit servers that had Broadcom NetXtreme II ...
You could change the priority of a process in Task Manager on the Processes tab. You would right click and choose Set Priority. The RRAS service is likely run through svchost.exe but I don't have a machine up and running to check that. You could go to the service and go to properties to see the path to the executable.
However, you don't really provide ...
A couple of things to try without seeing your full event log:
Try backing up your registry and then deleting the following key: HKEY_LOCAL_MACHINE\System\currentcontrolset\services\remoteaccess\routermanagers\IPV6 and then rebooting.
Try removing the RRAS role completely from the server in Server Manager Roles and rebooting then re-adding the RRAS role. (...