22
votes
Can I automatically ROUTE ADD xxxx after i make a VPN connection in Windows 7?
If you have multiple VPNs you might run into the issue that when they connect in random order, their interface IDs change. In that case the normal ROUTE -P ADD 10.0.0.0 MASK 255.255.0.0 10.0.0.1 IF 42 ...
- 369
20
votes
Accepted
What is the difference between AWS site-to-site VPN and AWS client VPN?
In general the protocol doesn't have much to do with it. You can have IPSec tunnels in both site-to-site or client (aka road warrior) configurations, just like you can have OpenVPN (TLS) tunnels in ...
- 24.2k
8
votes
Accepted
Site-to-site IPSec routing (Ubuntu, StrongSwan)
We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the ...
- 79k
6
votes
Is it possible to create a VPN link between AZURE VNET and AWS VPC?
I spent some time working on this today, and as far as I can tell, it is not currently possible. While you can get the gateway IP addresses and pre-shared keys synced up, you don't seem to have any ...
- 161
5
votes
Accepted
What are the VPN configuration requirements for site-to-site VPN with Azure?
Please have a look at the following:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices
According to the documentation, assuming all of your network information is ...
- 2,398
5
votes
Accepted
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
IPsec traffic should be routed, you probably hit the default NAT issue of the default NAT rule affecting IPsec traffic. The remedy is:
iptables -t nat -I POSTROUTING 1 -m policy --pol ipsec --dir out ...
- 774
5
votes
Accepted
Fixing 70% transfer speed slowdown over VPN compared as compared to SSH? (Tested OpenVPN, IPSec/L2TP, OpenSSH, SoftEther)
Given the link posted in the comments, I decided to take another look at this openvpn article:
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
I was able to achieve ~150Mbit/s ...
- 161
4
votes
Can I automatically ROUTE ADD xxxx after i make a VPN connection in Windows 7?
netsh interface ipv4 add route [destination/prefixlength] "[interface/connection name]"
I'm using that to deal with connections that have subnet overlap by adding static routes for hosts on the ...
- 228
4
votes
Client packets not forwarded over strongSwan IPsec site-to-site tunnel for client and gateway on the same server
If you have any NAT rules configured, like MASQUERADE via --add-masquerade, you have to exclude traffic that matches an IPsec policy from getting natted. Otherwise that traffic will just get natted to ...
- 3,870
4
votes
Accepted
Best practice for Domain Controller
It depends.
As you already know, if the site-to-site VPN drops your office computers will not be able to reach your domain controller: that will mean not only authentication issues, but that almost ...
- 69.3k
3
votes
Accepted
Azure backup VPN tunnel
Nope.
There are no settings for creating metrics and traffic priorities, you're also stuck with Dynamic Routing so all the prioritizing is done in the background.
This means that you cannot connect ...
- 3,859
3
votes
Openvpn routing for lan to lan through tun
OP posted the answer on forums.openvpn.net
Use this server config:
port 1194
proto udp
dev tun
topology subnet
mode server
tls-server
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt # ...
- 1,829
3
votes
Can I make a site-to-site VPN with a public IP on one side only?
Yes you can do this.
Evidence? I have an IPSec connection from our office in Albania to our office in Norway. The Albania office is behind CGNAT (the ISP provides only 10. addresses to its customers)....
- 1,589
3
votes
site-to-site vpn tunnel - does hardware matter?
Depends on your budget, but I'd pick up a few Cisco ASA 5505 or 5506-x units at ~$550 each.
Industry standard, reasonably easy to configure and no babysitting.
If you have dynamic IPs at any of ...
- 196k
3
votes
Accepted
Change Route Based S2S to Policy Based
Is it possible to convert the route based to policy based?
No,you could not covert route-based gateway to policy-based gateway. Once a virtual network gateway has been created, you can't change the ...
- 3,543
3
votes
Cisco ASA 5505 can't talk to anything on Site-to-Site VPN
Let me point out the general "hint" what to check based on your description. Hopefully it will help even it is not directly "copy&paste" solution. I am sorry in advance for not going through the ...
- 1,627
3
votes
IKEV2 IPSEC Autostart, restart, daemon
I assume that strongswan starts on reboot, since you don't mention using systemctl start strongswan (the command you cite systemctl status strongswan just tells you whether the service is running). If ...
- 5,477
3
votes
What is the difference between AWS site-to-site VPN and AWS client VPN?
you should always use TLS on the application layer anyway, even on top of client VPN
TLS is a protocol that has many different uses. The most common one is in HTTPS but many other protocols use it ...
- 645
3
votes
Accepted
How large does site-to-site VPN subnet need to be?
A site-to-site VPN usually is fully routed network. Meaning there is no NAT or anything. The subnet used for the VPN only needs addresses for the connected routers.
So the minimum size of the ...
- 130k
3
votes
AWS Site-to-Site VPN not working
In the solution that you've described, after all the configurations that you've mentioned you need to generate the configuration file for that connection using the menu on the top of the page and ...
- 350
3
votes
Accepted
Two DCs at home office, one remote office...DNS resolution?
What you want to do is to create a site-to-site VPN connection between the two offices. The remote office computers would use the same DNS servers as the main office, which presumably are your Domain ...
- 109k
2
votes
Accepted
site-to-site vpn tunnel - does hardware matter?
It really all boil down on the amount of internet bandwidth you have and how much of it you want be able to use for your VPNs.
Even low end firewalls (under 500/600 euros) are capable of 50+ Mb/s of ...
- 45.1k
2
votes
High availability and AWS VPN
The machine terminating the tunnel is a single point of failure already, isn't it? If so, running HAProxy right there seems like the thing to do (and I'm not just saying so because that's the way I ...
- 22.3k
2
votes
Accepted
Watchguard BOVPN and new ISP
OK, I eventually got this resolved.
I had to connect a laptop directly to the new connection, and show the ISP that pings to the remote firewall were failing. They finally looked at the IP routing, ...
- 1,503
2
votes
Accepted
Routing in Azure between point-to-site and site-to-site networks
Thanks!
The actual article for a Point-to-Site connection for Resource Manager was published by Microsoft last night to here
(Original text:
Not a direct answer for you, but according to this [...
- 191
2
votes
Routing in Azure between point-to-site and site-to-site networks
A Microsoft employee was kind enough to post a script for creating a point-to-site VPN using Azure Resource Manager model. The feature is undocumented at this time, but this script did the trick for ...
- 145
2
votes
Azure - multiple virtual network gateways?
As Drifter104 mention, you can connect multiple sites to the same VNet, but only through the same gateway (see here), you can't have multiple gateways on a single VNET. This is true currently both in ...
- 38.4k
2
votes
Accepted
VPN between 2 sites using Software only
What you're looking for is the Routing and Remote Access role in Windows Server. You'll want to configure a site-to-site VPN utilizing your servers at each site as a router/VPN gateway.
Of course, ...
- 100k
2
votes
Accepted
Cisco ASA Site-To-Site VPN change peer IP
Yes, you can change the peer IP address without create new Site-To-Site VPN
In general you have to change two parameters.
peer IP address
tunnel group name
According your link they changed only ...
- 36
2
votes
Accepted
Connect multiple corporate partner private networks
The easiest way would be a hub-and-spoke IPsec network, where you'd stand up a Linux/BSD server somewhere and then configure IPsec (using Strongswan) associations from that server to each LAN site. ...
- 109k
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
site-to-site-vpn × 453vpn × 191
ipsec × 91
azure × 58
routing × 43
cisco-asa × 43
cisco × 42
networking × 39
amazon-web-services × 37
openvpn × 35
strongswan × 28
sonicwall × 25
pfsense × 21
amazon-vpc × 21
cisco-vpn × 19
active-directory × 17
windows × 16
windows-server-2008 × 16
azure-networking × 16

nat × 15
openswan × 14
windows-server-2008-r2 × 13
linux × 11
firewall × 11