Always On VPN help please

[Squelch]

Hi everyone.

 

I have been configuring Always On VPN and have run into a problem that I cannot solve. The device tunnel connects successfully, the client picks up an IP from the DHCP server.

NSLookup > FQDN times out with Server: UnKnown and then the correct IP address of the DNS server. I can't ping anything

 

Much googling led me to think it is a routing problem. I know nothing about routes whatsoever.

 

In my DeviceProfile.xml file I have the following:

 

10.42.*.*

<<<

32

 

Once connected, the client's route table shows nothing like what I have set above.

 

Any help would be appreciated.

[3s-gtech]

In my XML I have the IP address set as 10.42.x.0 (where the x is the subnet of that server) with 32 as the prefix. I then have another route for another range I use.

 

Bear in mind that you need to clear the profile once it has been set on the client - it doesn't update or overwrite a previous configuration.

 

Remove-VpnConnection -AllUserConnection -Name "AoVPN_profile" (where that's the configured name of your profile).

[Squelch]

I do remove and then recreate the connection each time I make a change.

I have just tried changing the address to 10.42.*.0 but that has not fixed it. thanks for the suggestion.

 

The VPN server is domain joined so should already have its own route back to the DC. Perhaps I'm looking in the wrong direction.

[3s-gtech]

Did you put it as e.g. 10.42.6.0 (not a wildcard)? My routes don't have any wildcards in them. Not sure this is the cause of your issues - but can only relate what I have and it works here.

[Squelch]

Not a wildcard, in the profile I use the actual IP address, I was just masking my internal IP's on the interwebs in case I wake up to find my network encrypted by naughty people

[Squelch]

This might be something to do with it.

 

 

I'm using a single NIC, our Sophos XG is passing traffic from the external IP to the internal IP of the VPN server. Note that the lowest interface called Internal has the correct IP address whereas the highlighted interface is also called Internal and has a DHCP assigned IP address. I would have thought only one of these should be showing?

[3s-gtech]

I have the same, loopback and a static internal as well as a DHCP internal. I have an external too as that was the guide I followed. The actual server, in Control Panel, only shows one internal and one external NIC.

[Squelch]

I think I'm having the same problem as this guy.

 

 

On my client I have a route to the external IP of the VPN server, the gateway of this route is a 192.168.*.* address that my hotspot is providing. There is also an entry that shows the IP address received from DHCP with an On-Link gateway.

On the VPN server I have a route to my entire internal IP range.

 

I'm very confused.

[silvestre]

on your AOVPN server do a route print and share the output.

[Squelch]

10.42.88.0 is the start of the internal range, servers are in 10.42.92.0 vpn server is 10.42.92.58

 

[silvestre]

Try adding the following persistent routes

 

route -p ADD 10.0.0.0 MASK 255.0.0.0 (10.42.92.2 or whichever is your internal NIC gateway)

 

route -p ADD 192.168 .0.0 MASK 255.0.0.0 (10.42.92.2 or whichever is your internal NIC gateway)

 

 

route -p ADD 172.16.0.0 MASK 255.0.0.0 (10.42.92.2 or whichever is your internal NIC gateway)

[Squelch]

No change, the new routes are now showing as persistent in the route table.

[silvestre]

did you reboot the server?

 

route -p ADD 0.0.0.0 MASK 0.0.0.0 (external nic gateway)

 

You will need a full reboot.

[Squelch]

Still no change.

[silvestre]

can you post your XMl config.

 

Do you have two adapters one for external and one for internal?

 

your are using DT only?

 

Is the DT connecting fine?

 

what can you ping?

[Squelch]

I'm using a single NIC. Our Sophos XG is passing everything from the external IP to the internal VPN server IP

Both DT and UT connect successfully. I'm testing it with DT at the moment as I'm most interested in getting DT working for remote admin access

I can ping the internet but nothing internal, I'm getting an IP from DHCP but no DNS (both are on the same DC)

 

 

In the xml file I have masked trustednetworkdetection (FQDN), domainName (also FQDN) and Servers (which is the external IP of the XG)

[silvestre]

you have one route specified and that too its incorrect. 10.42.92.0/32 (10.42.92.0 is not a valid IP . With a /32 subnet you need to provide an actual ip for example. 10.42.92.20

[silvestre]

you will also need the DNS servers used on th e VPN server added to the route in DT.

[Squelch]

I changed that incorrect route to the internal IP of the DC and recreated the connection. Still no change.

Trying to find information about a single NIC config is nigh on impossible. As the vpn is single NIC I have set a static IP and included a gateway and DNS. Could that be causing the issue?

[silvestre]

single nic is supported with rras. try with route 10.0.0.0/8 to include your entire range and redeploy the profile.

 

you can check with powershell on the client to show route if the route is added.

 

You do not need to deploy a User tunnel unless you plan on using NRPT.

[Squelch]

ah, I added that last route, recreated the profile, reconnected the DT but the route isn't showing in the table. The client wouldn't need a reboot would it?

[Squelch]

This is the client route table. Maybe there's a problem with the xml profile?

 

 

[silvestre]

how are you deploying the profile?

[Squelch]

I'm using powershell in SYSTEM context as per this part of the guide I used.

 

https://www.configjon.com/always-on-vpn-device-tunnel/

 

I haven't tried to deploy it anywhere other than this test client.

[silvestre]

if the route is not showing then yes there is an issue with your xml