DirectAccess/RRAS routing to subnets/no access after enabling IPv4 router

[CAWJames]

Good evening learned people,

 

I have a strange one!

 

I have setup directaccess and sstp vpn on a 2016 server, which works great out of the box when accessing the immediate subnet. I am now trying to route to our various external sites(different subnets) and DMZ subnets, which are connected to or are on our Sonicwall NSA firewall.

 

I have added the static routes using the gateway address of the SW with the default metric of 256(this could be wrong?) 192.168.xy.0,255.255.255.0,192.168.x.200,256 where xy is the remote subnet and x is our local subnet. This didn't work, I could still only access the local x subnet.

 

I then thought I'd turn on IPv4 routing in the RRAS console, made sense in my head! But while the vpn connects, I now have no local subnet access at all. Everything looks fine in the console, logged in person, no errors, etc. I then unticked the IPv4 router and I still have no subnet access! Does enabling the router turn something else screwy I don't know about? The only way back to a single subnet accessing working VPN is borking the server and starting from scratch, so back to square one!

 

Any networking RRAS gurus got any tips or pointers in how to get RRAS working over multiple remote subnets and DMZ addresses?

 

Thanks kindly,

 

James

[kevin_lane]

That's quite a high metric value from my understanding you only give a metric higher than 1 if the primary gateway is down or you intend on using different gateways (someone please correct me if I'm wrong)

[Davit2005]

Where are you doing the Routing for the subnets is it on the RRAS server??.

 

A rough drawing may help us :-) .

[FN-GM]

That's quite a high metric value from my understanding you only give a metric higher than 1 if the primary gateway is down or you intend on using different gateways (someone please correct me if I'm wrong)

 

Nearly

 

You can use that metric but anything from 0 - 255 will superseded your static route, making it useless. However I think the Default Gateway has a metric of 261 (or it used to be if they have changed it).

 

If you use route print in the command prompt you can see your routing table. Does this show your static route? What did you set the gateway address to when you added the static routes? It should be the IP address of your vlan interface for your vlan you have the internal nic plugged into. If your server has 1 nic, and you plug into that internal vlan, it would be the default gateway for that.

 

Thanks

Edited February 10, 2017 by FN-GM

[CAWJames]

 

Thats my route print for IPv4. 192.168.100.0 being our home subnet, which the RRAS is at. 192.168.100.200 is the local default gateway SW which has the various VPN's and DMZ's on. The other 192.168.x.0 are the other subnets.

 

Still seems strange I have lost all connection after turning on the IPv4 routing option, and stranger that turning it off doesn't return any connectivity!

 

Any light?

 

Thanks

 

James

[FN-GM]

You're pointing at the wrong subnet for your gateway on the static route. It can't be right as its out of scope.

 

On the internal VLAN on the same network as your internal NIC is in on the server, if you plugged a laptop in, what default gateway would you use?

[CAWJames]

I would get 192.168.100.200 , 100.0 is our home subnet, where the RRAS is. Then we have a SW router with interfaces that provide 102.0 and 103.0, which are DMZ, then 2.0 3.0 and 200.0 are subnets at remote sites provided by the site to site VPN on the sonicwall.

[FN-GM]

Sorry ignore that last message. Looked at it wrong!!

 

What is the IP of the card in the internal network?

 

Thanks

[CAWJames]

The internal card of the RRAS server is 192.168.100.3

 

Thanks

 

James

[kevin_lane]

How.did you get on have you manage to solve this

[CAWJames]

No, had to clear the server and start again, back to single subnet working. Next time I will snapshot the server before I change any settings, keep forgetting! Still not sure why it won't route, although one thought occurs, how would the client know there are more subnets to route to? Should routing tables need to be adjusted on the remote client side? I did a tracert and it tried to run the subnet over the net at large rather than over the VPN. I do use split-tunneling though...I think I'm answering my own question here...

 

Thanks

 

James

[CAWJames]

I have been looking into automatic ways to add the right routes on the client, and have come across CMAK, but it says you have to have a separate 32bit and 64bit version, and 32bit can only be made on a 32bit server? Is this just old advice or does this not work on newer server systems, as there isn't a 32bit server anymore and hasn't been for many years!

 

Thanks

 

James