Solved W7 VPN connected but cannot access network or map network drive

[Rincewindwiz]

Answer #38 - see #39 unless I have misunderstood

TCP/IPv6: (Ricky in Melbourne)
Unticked on the server (incoming connection properties)
Was ticked on the client. Now unticked.
ipconfig /flushdns then
Ping 192.168.1.61
still produces general failure on server
Client ipconfig /flushdns
Ping 192.168/1/67 still produces general failure

On lcinet the vpn properties isn't bound to tcp/ip v6?

Do not bind the vpn tunnel to tcp/ip v6!

IPCONFIG ONly mention of IPv6 is
client: Tunnel adapter Teredo Tunnelling Pseudo Interface
Server: Tunnel adapter LAN connection #9 Teredo Tunnelling pseudo interface

Where should I look?

 

[Kaktussoft]

untick tcpip v6 on server incoming connection.
As well on vpn client connection.

Disconnect and reconnect client. Even better reboot server and client. Ping still has problems now?

 

[Rincewindwiz]

Hi
Did most of this before but, for the avoidance of doubt, the full story is . . . .

SERVER: connected to router. External IP 78.86.160.148
Incoming connection IPv6 unticked.
IPv4 has Allow callers to connect to network ticked
Assign IP address automatically
Allow calling computer to specify own IP unticked
Firewall off
PC rebooted
IPCONFIG says IPv4 is as follows
RAS Dial in interface 192.168.1.61 (preferred) subnet 255.255.255.255 (Why is this different? Does it matter? How do I change it?)
and LAN 192.168.1.67 (Preferred) subnet 255.255.255.0

CLIENT: VPN connection connects to 78.86.160.148
IPV6 unticked;
IPv4 Obtain IP and DNS automatically
Disconnect from LAN. Fire up wireless network
Use default gateway on remote network unticked
Automatic metric ticked
firewall off

PC rebooted
Access to SKY wireless obtained
IP address 151.228.229.56
Client: VPN connect (connects no problem fine)
IPCONFIG says
IPv4 address 192.168.1.61 (Preferred) Sames as RAS interface? Coincidence? matter?
DNS Servers 192.168.1.1 (Router)
Wireless LAN 192.168.0.22 (Preferred)

PING FROM CLIENT
78.86.160.148 OK
192.168.1.61 OK
192.168.1.67 times out

PING FROM SERVER
151.228.229.56 OK
192.168.1.61 General failure
192.168.1.67 OK
192.168.1.22 Reply from 192.168.1.67 Destination host unreachable

CLIENT will not see or connect to shares on server either by
name - Message "cant find name on network"
IP (\\192.168.1.61\share) - Message "Verify you typed "share" correctly and try again."
Network diagnostics say its found 192.168.1.61 but cannot find the share.
Properties of share on server confirm share name correct and permission for everyone.

 

[Rincewindwiz]

SOLVED ACCESS REMOTE NETWORK
In respect of the 198.162.1.61 'coincidence', I changed TCP/IP4 on the RAS to assign IP addresses in the range 192.168.11.21 to .11.41 and bingo, the whole problem goes away.
I can PING \\computer by name or number and I can see \\Computer\shares and I can set up network drives

In order to avoid possible conflicts there must be other ranges of IP addresses I can set the RAS interface to provide that are less common that the usual 192.168.x.x set? What would be the best range?
10.0.0.0 through 10.255.255.255 or perhaps 172.16.0.0 through 172.31.255.255?

Still no internet access even if I tick use default gateway on remote network (which IIRC is the default)

So how do I get Internet Access through the VPN?

 

[Kaktussoft]

I changed TCP/IP4 on the RAS to assign IP addresses in the range 192.168.11.21 to .11.41 and bingo

Please post ipconfig from server and client again please (when vpn connection is active). also print route -4 output of client.

Can the client ping other machine on remote site? so 192.168.1.1 for example? I bet that isn't working! Programs on client doesn't know where to drop packages sent to 192.168.1.x

So you can only access remote server (not remote lan). Also remote lan cannot access the vpn client. Even if that were possible he can't route the answer

 

[Kaktussoft]

So how do I get Internet Access through the VPN? => I'll think you actually mean.... how can I use Internet (browse pages, read mail, listen internet radio) while connected to a vpn server. Correct?

 

[Rincewindwiz]

Yes
Sorry for my poor English

 

[Kaktussoft]

Yes
Sorry for my poor English

Please post the things asked in #45

 

[Rincewindwiz]

Server IPCONFIG

Windows IP Configuration

Host Name . . . . . . . . . . . . : Ponder
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
Physical Address. . . . . . . . . : 00-22-FA-D8-C1-5F
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) WiFi Link 5100 AGN
Physical Address. . . . . . . . . : 00-22-FA-D8-C1-5E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) 82567LM Gigabit Network Connection
Physical Address. . . . . . . . . : 00-23-18-96-E4-41
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.67(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 9:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fd:3c0e:565:3f57:febc(Preferred)
Link-local IPv6 Address . . . . . : fe80::3c0e:565:3f57:febc%25(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{6C11DF96-CAF9-4217-9FFD-E178A7E26AFC}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes



PING From Client (on external wireless connection)
Can Ping 192.168.1.1 but this is the LAN address of the router.


Client IPCONIG
Windows IP Configuration

Host Name . . . . . . . . . . . . : R60
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Home

PPP adapter Hewitt VPN:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Hewitt VPN
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.11.22(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : Home
Description . . . . . . . . . . . : Intel(R) PRO/Wireless 3945ABG Network Connection
Physical Address. . . . . . . . . : 00-19-D2-98-12-AD
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::29f1:c508:71a2:fe30%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.22(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 10 March 2014 13:01:52
Lease Expires . . . . . . . . . . : 11 March 2014 13:19:39
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 167778770
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-16-5D-DD-31-00-16-D3-B9-92-6B
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-16-D3-B9-92-6B
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{BD39B3AB-E5D5-4B98-B418-B1590DA03948}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.Home:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : Home
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:8b7:3d32:3f57:ffe9(Preferred)
Link-local IPv6 Address . . . . . : fe80::8b7:3d32:3f57:ffe9%12(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter 6TO4 Adapter:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes





PING
Client can ping
server by computer name but NOT by LAN IP address (.1.67)
external ip address 78.86.160.148
Client cannot ping another comuter on the LAN network (.1.69)

Server can ping
other computer on LAN (.1.69)
RAS IP address (.11.22)
Client external IP .229.56
Cannot ping client by name

Please post ipconfig from server√ and client√ again please (when vpn connection is active). also print route -4 output of client.√

Can the client ping other machine on remote site? so 192.168.1.1 for example? I bet that isn't working! Programs on client doesn't know where to drop packages sent to 192.168.1.x√

So you can only access remote server (not remote lan). Also remote lan cannot access the vpn client.√ Even if that were possible he can't route the answer

Yes. But it is a step forward!!

 

[Kaktussoft]

Post ipconfig output again from server please. But now when vpn client is connected!!
Post route -4 print output as well on SERVER when vpn client connected.
----------------
btw remote subnet is 192.168.1.* (on server side)
client subnet is 192.168.0.* (so client side)

But assume client and server don't know each other and are totally disconnected. How will they know each numbers?? Of course not possible.

After creating the vpn tunnel (192.168.11.22 subnet 255.255.255.255) the client and server know how to reach each other.

But how can other computers on server side know where 192.168.0.* is? They don't know
But how can other computers on client side know where 192.168.1.* is? They don't know.

on server: \\192.168.11.22 it shows the client shares?

You want vpn-client to see all computers on server side?
You want vpn-server to see all computers on client side?
You want all vpn-server side computers to see all client side computers?

 

[Kaktussoft]

PING From Client (on external wireless connection)
Can Ping 192.168.1.1 but this is the LAN address of the router.

on client it's impossible to ping 192.168.1.1 now!! Don't lie.
Client doesn't know where 192.168.1.* is !

 

[Rincewindwiz]

Thank you for your continued support.

re 02:27 Post
It might go a little faster if you made some attempt to explain what was going on. You ask me to do a whole bunch of stuff with no rationale so it is hardly surprising if I get some of it wrong. If I dont know why I am doing something I can hardly spot a stupid result and double check what I did.

For example, it seems to me client knows where 192.168.1.1. is because client knows where server is and server knows where router (.1.1) is

If you want to stop because you think it is all too difficult or I am too stupid or I am a liar, please just let me know.

re 02:23 Post
This is much more helpful to my understanding of what is going on.
In answer to your questions:
serverside subnet - correct.

Client side: The client not on a LAN. Client is using
198.162.0.* to talk to external wifi (WAN?) - if this is a subnet then OK
198.162.11.22 to talk to VPN - if this is a subnet then OK

My 'model' of what is going on is that client talks to internet wifi (IP known); internet wifi talks to external router (IP known); router talks to server (port forwarded) and server talks to LAN (IP known). This suggests the client shoul dbe able to see other devices on the LAN (if the server permits it)

I presume the server would see computers on the client LAN (if there was one) by reversing the flow described.

In answer to "You want":
The aim is to get a proper VPN working. As I understand it this means:-
- CRITICAL: client can access files on the server
- IMPORTANT: client can access internet via the LAN (or set default gateway different and access internet locally)
- OF SOME VALUE: client can see computers on LAN
and, fo course, the Server can respond to computers that are communicating with it

I dont care whether server can see computers on client LAN - especially since client would not generally be on a LAN. However, if this is supposed to happen in a VPN, it would be nice to have it happen

What Next
Now if I had some idea/model of how all this IP addressing was supposed to get computers to talk to each other of a LAN/WAN that would be great
If you need anything more, let me know and I'll try to do it correctly

 

[Kaktussoft]

- CRITICAL: client can access files on the server=>already works...isn't it?
- IMPORTANT: client can access internet via the LAN (or set default gateway different and access internet locally)=>already works... isn't it?
- OF SOME VALUE: client can see computers on LAN=>his own LAN or the remote LAN?

I don't call you a liar. I meant to say, "what you write is impossible."


"For example, it seems to me client knows where 192.168.1.1. is because client knows where server is and server knows where router (.1.1) is "=> The client knows where 192.168.0.1, 192.168.0.2 etc and 192.168.11.22 is. But doesn't know where 12.13.14.89, 13.67.45.12 and 192.168.1.67 are. Because he doesn't know he sends it to its default gateway so 192.168.0.1.

To enable client to see all computers on server lan we have to add the route on CLIENT.
on client:

route add 192.168.1.0 mask 255.255.255.0 192.168.11.21

You have access to settings remote router's LAN? We have to set a static route there as well.

Network is not as easy as it looks..... difficult to explain

 

[Rincewindwiz]

Now I am (even more!) confused . . .
Why am I directing/adding a route from .168.1.0 to .168.11.22?
The client is using .168.0.22 with a default gateway of .168.0.1 and a DNS server of the same and I see no mention of a .168.1.0 anywhere?

And yes, I have access to remote router's LAN. What address/route do I need to set up there?

 

[Kaktussoft]

192.168.11.22 is the address of the vpn-tunnel. All tcpip traffic to 192.168.1.* must be routed throught the vpn tunnel so 192.168.11.22. If done correctly the vpn-client can access the server and all other 192.168.1.* computers. But..... they cannot respond back yet.

 

[Kaktussoft]

On server do: route add 192.168.0.0 mask 255.255.255.0 192.168.1.67
On router on server side do: route add 192.168.0.0 mask 255.255.255.0 192.168.11.22 But the router isn't running win7, so you have to issue another command.

But is it really neccessary to see all remote computers?

 

[Rincewindwiz]

192.168.11.22 is the address of the vpn-tunnel. All tcpip traffic to 192.168.1.* must be routed throught the vpn tunnel so 192.168.11.22. If done correctly the vpn-client can access the server and all other 192.168.1.* computers. But..... they cannot respond back yet.

Ahha so I am telling the client that anything to do with the 192.168.1.* network should be sent to the vpn-tunnel (.11.22) - seems reasonable. But how does the client know it needs to access .168.1.*? Do I have to access via IP address?

On server do: route add 192.168.0.0 mask 255.255.255.0 192.168.1.67
On router on server side do: route add 192.168.0.0 mask 255.255.255.0 192.168.11.22

Easy enough

But the router isn't running Windows 7, so you have to issue another command.

Indeed, its just a router. On the router it seems I can create static routes with a series of records that have
Destination IP, Subnet Mask, Gateway. So I use these records to allow the router to redirect requests to the client network (192.168.11.22) to the client network gateway IP which is the external IP address that the client gets from his Wifi provider?

But is it really necessary to see all remote computers?

see #52
NO - this part merely of some value primarily my better understanding and thank you for your help.
Critical - access server files remotely is solved
Important - access internet via server is outstanding and the problem here seems to be that the RAS interface on the server is listed as having no internet connection. How do I fix this?

 

[Kaktussoft]

So I use these records to allow the router to redirect requests to the client network (192.168.11.22)=>you are paritally right. 192.168.11.22 is the vpn client , not the vpn client network.

But for the other things.... you are starting to understand how it works.
----------------------------
So forget all the route commands for now (they are not permanent now anyway, so a reboot will distroy what you did).

Normal internet browsing on client doesn't work anymore when vpn client is connected? On client does ping 198.211.122.92 work then?

Do you really want to access the internet over the VPN-tunnel? Why?

 

[Rincewindwiz]

Normal internet browsing on client doesn't work anymore when vpn client is connected? On client does ping 198.211.122.92 work then?

internet browsing is fine until I tell the client to "use the default gateway on remote network" (see #25) Then the internet is unavailable.

This is why it seems relevant to me that the server shows no internet connection on the RAS interface.

Do you really want to access the internet over the VPN-tunnel? Why?

I travel overseas and some UK TV material is not available in foreign countries. I am presuming that accessing the internet through the VPN will overcome this problem.

 

[Kaktussoft]

internet browsing is fine until I tell the client to "use the default gateway on remote network" (see #25) Then the internet is unavailable.=>that adds a default route (so for anything no routing has been defined [so any website and 192.168.1.*]) to the routing table. Effectively it routes everyting through the tunnel. On outside of tunnel it is on vpn it routes to its router (the remote router) and goes on the internet. But the remote router doesn't know where the vpn-tunnel is!! So it can't send the response back!

So what you have to do is: tell remote router where 192.168.11.22 is!
On remote router: route add 192.168.11.22 mask 255.255.255.0 192.168.1.67

On client make a vpn-connecton. client to "use the default gateway on remote network" is ON. Now create route -4 print output again. client can then ping 192.168.1.67 succesfully? If so \\192.168.1.67 shows remote shares?

on remote server \\192.168.11.22 shows vpn client shares?