VPN Clients unable to ping anything at all

[Divaldo]

Hello,

 

I am hoping this is an easy fix, it seems like it should be.

 

I've literally spent the entire day trying to get a bog standard unsecured PPTP VPN set up on Server 2012 R2 with a single NIC. I've done it a million times before but for some reason it just won't work.

 

My clients can connect fine, but once connected and authenticated, they cannot access anything. No internet and no internal resources, they cannot even ping anything by IP address. Once connected I tried pinging google (8.8.8.8), my router's IP address, my internal DNS server's IP address and the RRAS server's IP address, no response from any of them.

 

My clients are Windows 10. I initially tried L2TP with a pre-shared key, but was not even able to get authenticated, so I thought I'd take it back to basics first with PPTP.

 

If i run 'route print' once connected, i get this:

 

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.2 4265

0.0.0.0 0.0.0.0 On-link 192.168.129.231 26

[MY VPN SERVER IP ADDRESS] 255.255.255.255 192.168.1.1 192.168.1.2 4266

127.0.0.0 255.0.0.0 On-link 127.0.0.1 4556

127.0.0.1 255.255.255.255 On-link 127.0.0.1 4556

127.255.255.255 255.255.255.255 On-link 127.0.0.1 4556

192.168.1.0 255.255.255.0 On-link 192.168.1.2 4521

192.168.1.2 255.255.255.255 On-link 192.168.1.2 4521

192.168.1.255 255.255.255.255 On-link 192.168.1.2 4521

192.168.128.0 255.255.254.0 On-link 192.168.129.231 26

192.168.129.231 255.255.255.255 On-link 192.168.129.231 281

192.168.129.255 255.255.255.255 On-link 192.168.129.231 281

224.0.0.0 240.0.0.0 On-link 127.0.0.1 4556

224.0.0.0 240.0.0.0 On-link 192.168.1.2 4521

224.0.0.0 240.0.0.0 On-link 192.168.129.231 26

255.255.255.255 255.255.255.255 On-link 127.0.0.1 4556

255.255.255.255 255.255.255.255 On-link 192.168.1.2 4521

255.255.255.255 255.255.255.255 On-link 192.168.129.231 281

===========================================================================

 

If I run 'route print' BEFORE connecting to my VPN, i get this:

 

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.2 40

127.0.0.0 255.0.0.0 On-link 127.0.0.1 331

127.0.0.1 255.255.255.255 On-link 127.0.0.1 331

127.255.255.255 255.255.255.255 On-link 127.0.0.1 331

192.168.1.0 255.255.255.0 On-link 192.168.1.2 296

192.168.1.2 255.255.255.255 On-link 192.168.1.2 296

192.168.1.255 255.255.255.255 On-link 192.168.1.2 296

224.0.0.0 240.0.0.0 On-link 127.0.0.1 331

224.0.0.0 240.0.0.0 On-link 192.168.1.2 296

255.255.255.255 255.255.255.255 On-link 127.0.0.1 331

255.255.255.255 255.255.255.255 On-link 192.168.1.2 296

===========================================================================

 

 

 

My IP address at home where i am testing it is 192.168.1.2

subnet mask at home is 255.255.0.0

default gateway at home 192.168.1.1

 

When connected to the VPN, the PPP adapter details are:

IP address: 192.168.129.231 (this came from the pool i set up within the properties of the RRAS server)

Subnet mask: 255.255.255.255

Default gateway: 0.0.0.0

 

I have tried removing routing and remote access and adding it again, I've rebooted the server, restarted services, nothing seems to make any difference.

 

Can anyone see what I'm missing?

 

Thanks

[Divaldo]

A couple of other bits that may be of note, when I am connected to the VPN, the RRAS IS able to ping my laptop's PPP IP address.

I have disabled the firewall on my laptop.

I have disabled the firewall on the server.

[Divaldo]

i've noticed there was an outdated reverse lookup zone within DNS on the DC, for a non-existent IP range, I have deleted that, but it's made no difference.

 

I think i'll just install a new server instead.

[mrwoberts]

Couple of things to try...

 

Are the client and Server network types appropriate? The server is almost certainly going to be 'Domain', but when testing the client (externally) what network type is it set to - It should be Home/Work and not Public.

 

Also, in the configuration setup of the VPN, I personally untick the 'Use default Gateway on remote network' - this prevents all internet traffic going through VPN.

 

Please could you capture the output of this command, and obscure/change anything that is sensitive, before posting the results here.

 

ipconfig /all

[Divaldo]

I have PPTP working now!

 

It was a case of removing the server from the RAS and IAS Servers group in AD, and re-adding it again. I don't know why, the name didn't change and it's the same server, but that seems to have fixed it.

 

Tried flipping over to L2TP and that still wont work, but the original problem is resolved.

[Divaldo]

just a quick note to say I have changed nothing, but i am now back to the same issue again. PPTP connects, but connected clients cannot ping or connect to any internal resources or access the internet.

 

Using the VPN connection whilst on site works fine, it connects and I can access everything. Externally though, nothing.

[Divaldo]

slight change today. I've altered nothing, but i can ping the RRAS server's internal IP address when connected remotely over VPN. I can't ping it by name, and I can't ping anything else on the internal network, no DC's or DNS servers. Just the RRAS server.

 

So I'm assuming that is blocking everything somewhere. I disabled the firewall on the RRAS server, but that made no difference.

[Divaldo]

spoke too soon, disconnected and connected again and now I can't ping anything, not even the RRAS server.

 

I think I might jump out of my windows soon and end it all.

[Divaldo]

gave up in the end, removed Routing and Remote access, set it up on another server, changed the NAT rules to point to the new server, now nothing can connect to VPN at all.

 

Going to the pub.

[Divaldo]

after rebooting my router, i can now connect to the PPTP VPN set up on the new server. Same issue though, i cannot ping any internal IP addresses, not even the RRAS server.

[Divaldo]

if i create a NAT rule on my fireall to allow me to RDP into the RRAS server, i can connect fine. If I then stay connected over RDP, then connect my VPN, despite my internet access dying and being unable to ping anything, my RDP session stays live and working. Is that a clue as to what is going on? Port 3389 stays live, even though port 80 does not.

[Divaldo]

After trying to untick 'use default gateway on remote network' AND disabling ipv6 on the properties of the VPN connection, I seem to be making some progress.

 

Once I do that and connect, for around 1 minute everything works, I can browse the internet fine AND connect to resources on the corporate network. If I ping server with their FQDN i get replies, and if I ping domain.internal, that also gives me a reply.

 

However, after around 1 minute, it all stops responding again. I get pings timing out and can no longer access anything. If I disconnect and reconnect, the cycle begins again.

[Divaldo]

seems to be a random time from 30 seconds up to around 5 minutes that the drop out occurs. Leaving a ping-t running eventually fails to respond and gives me 'request timed out' instead.

[Divaldo]

and it appears the more i'm doing while connected, thr quicker it drops out. For example if i just leave a ping running, it stays connected for a while, i've seen 11 mins as the best so far. If I start opening file shares, it drops out within a few seconds.