Help forum for remote working!

[synaesthesia]

Hi,

 

I've spent the majority of the last week troubleshooting connection issues relating to our Always On VPN setup. 90% of our staff have absolutely no problems - a couple don't have good enough broadband (thought someone was joking when their fast.com report stated 22Kbps. They were not.) but ISP's seem to like putting a fair few blocks in the way. So I thought it may be wise to have a few tips here in one place, feel free to add anything that may be of use!

 

1. Disable "Family Safety Settings" - aka Web Safe, Family Safe etc depending on the ISP. This appears to be the most common culprit, meaning either intermittent connection or none at all. Downside is, particularly if the teacher has kids, no filtering but have to balance the means!

2. DNS - particularly with Virgin Media who on some connections appear to append some real ropey looking things to their DNS entries. For instance, resolving our website for a few users via nslookup brings up http://www.ourwebsite.org.uk.ourinternaldomain.internal ! Set the router or wifi connection DNS to Google/Cloudflare instead.

3. DMZ - putting the laptop on the teacher's DMZ is another good method of working around anything but please be aware, if using split tunnelling this means they have no middleman protection from their laptop to the outside world. Has resolve an issue on Virgin for us where we couldn't even get in from Teamviewer. "Protection against scammers" is a great thing but a PITA when you're legitimately trying to use it to help someone!

 

It's been horrible trying to explain to laymen why these things cause issues, certainly when each ISP will usually have 3 or 4 different routers and 4 or 5 different setups for each, and not making it sound like you're trying to pass the blame onto them!

[chazzy2501]

if it works from home great, if not they have to come in Sorry your internet / router sucks.

 

EDIT: sorry sounds snarky, our policy is a little more nuanced than this but that is the jist of it. Good news is that safeguarding is more relaxed on site.

Edited January 11, 2021 by chazzy2501

[synaesthesia]

Yeah, we have that for those particularly bad cases, although we're trying as hard as we can to keep people out of school. There's already too many in, staff & student which undermines everything, and we've got it easy as secondaries. Primaries have around half their kids in which is smegging ridiculous.

[MatthewL]

Sorry but changing end users home router settings, if anything goes wrong you get the blame for it, its a big no no from me on that one.

[synaesthesia]

We're not doing it, I'm walking them though. Wouldn't normally go near it, but asking them to phone their ISP to explain something they don't understand when they finally get through after 2 hours on hold... I'm a human, I wouldn't want someone else to go through that - I'd rather catch COVID.

 

Just to add, explaining fully what the issue is, what the settings are and what they do, and ensuring they understand how to change back should they need.

[free780]

Yep I did a help sheet for our helpdesk team.

Sorry if these have been mentioned before.

 

-Make sure the Xbox Live Networking Service is disabled on the client. It can interfere.

-Sky Customers need to whitelist your VPN address. - https://www.sky.com/help/diagnostics/sky-broadband-shield/cant-use-a-vpn

-Virgin Media can sometimes hijack DNS for non resolvable lookups. This will be all your internal DNS entries. It needs to be disabled by the user here. https://my.virginmedia.com/advancederrorsearch/settings . You will see internal lookups resolve to 92.242.132.24 or similar IPS. I wouldn't be surprised if other ISPs are doing this, they use a company called Barefruit.

-Enable the VPN GUI in the network list. Always On VPN Device Tunnel Status Indicator | Richard M. Hicks Consulting, Inc. (richardhicks.com) Users can click Connect if the VPN fails to connect.

-Rasdial from an administrator command prompt to disconnect and reconnect.

-If Users can use wired connections to their router the experience is a lot better.

-Be prepared that ISPs will change things with no warnings which can impact connections.

[chazzy2501]

direct access is a underperforming pain of a VPN because it is using HTTPS. (in my case) this however makes it very compatible with home router configurations. I wanted to move to always on VPN but the domain requirements/ complexity are quite high.

[cstreet]

You can fix the DNS hijacking by setting the DNS suffix search order in windows.

 

For some reason Windows appends the domain on all requests when on a domain joined PC.

 

On Virgin, try doing nslookup for google.com and you get google com.mydomain.org.

Try nslookup mydomain.org and you get mydomain.org.mydomain.org.

 

If you set the append suffix search order in windows networking to...

 

. (Dot on it's own)

Mydomain.org

 

...then it fixes the problem. The dot on it's own means - don't append any suffix.

 

The reason the default DNS suffix behaviour doesn't work with many remote access methods is because the connection attempts to resolve...

 

Myservice.mydomain.org.mydomain.org.

 

...which on Virgin will resolve to their bogus DNS intercept IP.

[synaesthesia]

Aha, great stuff, manyu thanks @cstreet!

[computer_expert]

Virgin media at least offer the option to turn off their DNS hijacking ("Advanced Error Search") here https://my.virginmedia.com/advancederrorsearch/

 

But then you would fall into the dark depths of @MatthewL's comment

[MatthewL]

Question for those end users with Virgin Media using DA or AoVPN anything having huge slow down issues and latency until the VM router is rebooted?

[Norphy]

I’ve got Virgin Media and I have been using AO-VPN since last March and I can’t say I’ve noticed that issue. That said, I’m not using the routers wireless radios, I have an Aruba InstantOn access point handling that.

[synaesthesia]

Seen it for a couple of ours users yes - both on virgin with a 200mbit connection with decent latency levels, nearly unusable or outright unstable regardless of whether they're using wifi or wired. The above may be a happier alternative to fiddling with personal routers.

[MatthewL]

I've actually got my VM in modem only mode and use PFsense box, got a new router to swap to at some point to see if it improves, power levels are all ok. Someone mentioned about tweaking the MTU settings not sure if that's over the top though?