1. Check L2TP ports existence
First check whether there are actually L2TP port configured in Routing and Remote Access (RRAS).
Click Start, click Administrative Tools, and then click Routing and Remote Access.
Expand your server, and then expand ports.
In case there are no entries for WAN Miniport (L2TP)..., add them by right clicking ports.
2. Check RAS ...
Locked the keys in the car, eh?
I don't believe that one is configurable via Group Policy. Periodic policy refresh isn't going to help you run a script or install software on the machine since both of those operations only occur on a synchronous policy refresh (i.e. a reboot).
I think you're going to be stuck laying hands on the machine.
I've forgotten ...
So I've managed to figure this out after a lot of digging around, I am able to use the native Azure Site-to-Site VPN functionality with OpenSwan which runs on a linux box (Raspberry Pi/Arch Linux) behind my home network's NAT router.
192.168.0.0/24 - Home network
192.168.1.0/24 - Azure network
192.168.0.1 - Home router's private IP
Performance for any VPN solution is typically limited by the available bandwidth between the clients and the termination point. Unless you have an extraordinarily large pipe and a significant amount of remote users (thousands), it's not going to make a difference. And if you do have that volume, you should look at load-balanced VPN concentrators rather than ...
Yes System 256 2001:470:xxxx:yyyy::/64 13 Internet
Yes Manual 256 2001:470:xxxx:yyyy::/64 21 RAS (Dial In) Interface
Your Internet subnet and RAS subnet need to be different subnets. Pick one, assign it to your RAS subnet and ensure your IPv6 gateway knows to route that subnet to your RRAS server.
Finally found the correct steps on how to create a VPN on Windows Server 2016 in AWS. Once connected, the client is able to access resources within the VPC and still access the Internet. Here's the complete list of steps on how it was done for those interested.
Setup the instance and needed interfaces:
Spin up a Windows Server 2016 instance in EC2 with 1 ...
You also need to confiugre the route back to the internal network.
On your default gateway (192.168.100.1), there is probably a default gateway to the outside world. This gateway also knows the 192.168.100.0/24 network, as it is directly connected.
It does not know the internal 192.168.200.0/24 network, and will use the default route to reach that.
I found them at c:\Windows\System32\LogFiles - The RRAS logs are in form INI####.
Also of note, you need to have logging turned on for RRAS if you want this to work properly. Directions on how to do so are over here: http://technet.microsoft.com/en-us/library/ee922651(v=ws.10).aspx
If your proxy can also route traffic, you can just configure RRAS to route all traffic from the NAT interface to the proxy. If your proxy does not route, then you should use something like GPO to enforce proxy settings on browsers inside of your network and block outbound traffic that does not go through the proxy at your firewall.
I thought I'd provide a more generic Linux router scenario for users not using pfSense but a Linux based router (in my case DD-WRT).
ip -6 route add xxxx:xxx:xxxx:xxxx::/64 via xxxx:xxx:xxxx:xx::x dev br0
The configured IPv6 prefix in RRAS IPv6 tab needs to be added after the add
The IPv6 LAN IP address of the RRAS box is the via (essentially the gateway)
The do-nothing properties button on the ipv4 protocol is a ubiquitous problem in Windows 10. The problem has been widely reported long ago (before Windows 10 was even released) so do not expect a fix anytime soon. (Update: This is fixed in Win10TH2)
The only way I could manually set the DNS settings was to modify the rasphone.pbk file in C:\Users\&...
In general, this article is pretty similar to your problem.
Strongswan (IKEv2) connection established, but no traffic routing
I guess this might help you also.
$ iptables -t nat -A POSTROUTING -o eth0 ! -p esp -j SNAT --to-source "your VPN host IP"
You can use Network Policy Server (NPS). It's a feature of Windows, you can add it to any Windows Server, Network Policy and Access Services (NPAS) feature. You can then add policies to connected clients, for example to make some checks if they are fully patched.
You can continue to use Windows 2016 Server RAS of course.
I had used it effectively in the past,...
This is how Windows unfortunately now handles routes when given an IP via PPP. It decides to put a route in by its self and guess the subnet mask based on the old clasful system. Terrible pain the rear this is.
You could change the priority of a process in Task Manager on the Processes tab. You would right click and choose Set Priority. The RRAS service is likely run through svchost.exe but I don't have a machine up and running to check that. You could go to the service and go to properties to see the path to the executable.
However, you don't really provide ...
According to microsoft documentation RRAS is supposed to be applied only to server versions of operation systems (http://technet.microsoft.com/en-us/library/dd314183(v=ws.10).aspx). So you'll have to deal with setup of server OS.
A couple of things to try without seeing your full event log:
Try backing up your registry and then deleting the following key: HKEY_LOCAL_MACHINE\System\currentcontrolset\services\remoteaccess\routermanagers\IPV6 and then rebooting.
Try removing the RRAS role completely from the server in Server Manager Roles and rebooting then re-adding the RRAS role. (...
I had success adding a route after connection, where 192.168.10.0 is the machine I'm trying to connect to, and 255.255.255.0 is the submask of the network:
route add -net 192.168.10.0 netmask 255.255.255.0 dev ppp0
See PPTP Client Routing for more details - you can also add scripts to /etc/ppp/ip-up.d/ to set up routes automatically on connection, detailed ...
If you change your VPN connection to use L2TP then it will require a certificate from the client.
Both these articles contain details about the implementation of this:
Alternately you can use a Network Policy Server policy, ...
I've found the solution for this in case you still need it:
Right Click on every Interface in the RRAS Console in the General section.
Select properties and click on incoming filter
click new and add every other vlan with its ip address range as destination network except the one you are currently configuring of course
I'm guessing you want to route basically all traffic through the VPN.
Without seeing your routing tables, my suggestion is the usual problem in this case: the VPN traffic can't itself go over the VPN.
Ensure that you have a route for the VPN endpoint specifically (i.e. you aren't relying on the default route to get to the VPN server you connect to on the ...
Whilst @EEAA's point about Windows 8 not being a server is entirely valid there are some bits of hackery that may help?
First of all I am assuming that you are concerned with ensuring that the RRAS service is running, in which case you have a couple of options.
Your first is to query your event logs and locate why the service is stopping, resolve that ...
Your's is the most comprehensive question so I will provide my input here.
From my testing in Windows Server 2012 R2, I can restore this functionality without rebooting by doing the following:
Unfortunately you have to force the restart of sstpsvc, which also requires Routing and Remote Access to restart, effectively ...
The DNS server will register the ip address for each interface that it is bound to. The fix is to "unbind" the 192.168.18.1 interface in the DNS server properties.
From the DNS management console, right click the server, select properties from the context menu, and on the interface tab select the Only the following ip addresses radio button, and uncheck the ...
As it turns out, the defaults for the DHCP relay agent simply don't work for some L2TP clients.
When you set up an interface for DHCP relaying in RRAS (on the "Internal" interface, where VPN clients go), the default options look like this:
It looks unassuming, but the cause of this entire issue is the "Boot threshold" setting. The ...
Can you try the work around to change below registry key value and restart DHCP Client service?
Key name: RequiredPrivileges
I tried the registry fix and it worked for me.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Dhcp" /v RequiredPrivileges /d "SeChangeNotifyPrivilege"\0"SeCreateGlobalPrivilege"\0"SeImpersonatePrivilege"\0 /t REG_MULTI_SZ /f
What if you add a static route on your servers telling them that in order to reach 10.128.0.0/20 they have to go through the VPN's server LAN address?
route add 10.128.0.0 mask 255.255.240.0 a.b.c.d
Substitute a.b.c.d with the VPN server's LAN address.
This will, at least, rule out problems with amazon's routing.