VPN Internet routing problem

Have a question or want to start a discussion? Post it! No Registration Necessary.  Now with pictures!

Threaded View
Hello

I have a Windows Server 2003 configured as a remote access VPN server.
Everything works perfectly, however when I connect from a client
machine to the VPN my internet connection get taken over by the
server's internet connection, anotherwords, not only it is routing my
LAN but also the internet connection the server is on.

Is it possible not to have the internet routed, just the LAN ? But
still be able to use client's internet connection ?

Thanks


Re: VPN Internet routing problem
ioevanc@gmail.com schrieb:
Quoted text here. Click to load it

This by design.

Once your VPN connection is open the VPN client should only allow
traffic through the tunnel for security reasons (keyword here is "Split
tunneling").

This also means that once Your PC has the VPN connection open the pc
cannot see the lan anymore (to protect the corporate network from being
infiltrated by rogue pcs...


--
Martin Bodenstedt

(www.die-bodenstedts.de / www.maboko.de)

Re: VPN Internet routing problem
Martin Bodenstedt wrote:
Quoted text here. Click to load it
Martin is correct, however I'm sure you can still see the local subnet
Martin, it's only the default route that's affected.

With the windows client you can get round it though if you consider the
risks worthwhile, here's what I posted the other day in response to a
similar question
"Yes it's a security risk if the remote computer becomes compromised, as
the internet connection going out locally could allow a back door into
your network when the client vpn is connected. However with the ms
client you can open up split routing to do what you need, in the tcpip
properties of the remote PCs connection to you under advanced untick the
'use default gateway on remote network' then only traffic destined for
the subnet that the client vpn address gets goes down the tunnel, all
else goes out locally. If there is more than one subnet at your location
the remote clients would need to use the route add command to add the
additional routes needed. "
simon

Re: VPN Internet routing problem
Thanks for your help, I apreciate it

Simon wrote:
Quoted text here. Click to load it


Re: VPN Internet routing problem
Simon schrieb:

Quoted text here. Click to load it

That should not be the case as all local pcs (those in the same subnet)
could still use the tunnel which I as a corporate network admin would
never tolerate.

A good vpn client permits no traffic through the tunnel other than from
(or to) the local machine itself.



--
Martin Bodenstedt

(www.die-bodenstedts.de / www.maboko.de)

Re: VPN Internet routing problem
Thanks for your help !


Site Timeline