Alright, I have a Windows 2008 server running. It serves up DNS but not DHCP. I want to have VPN running on it, and my understanding is that you can do this as long as you set the DHCP relay server properly.

I've added the 'internal' and 'LAN' interfaces to the DHCP relay agent and enabled forwarding on both interfaces. When I connect in, I do get an IP address but if I watch the logs, its sending out broadcast messages looking for a DHCP server, but not getting anything back.

When I check the DDHCP relay agent, it looks like its discarding all of my requests, and either not forwarding them on to the DHCP server, or not sending them back to the client (I can't tell which).

My first question is, how can I make that work, what am I missing?

The second question is, can I run OpenVPN on the server and achieve the same result, but also have it tie in to ActiveDirectory for authentication?

EDIT #1: With regards to the above (question #2) I actually installed SoftEther VPN, configured it for L2TP and had it authenticating against ActiveDirectory. Everything went great, except I ran into the same problem: I can establish a connection briefly from my laptop to the VPN server, but get no DHCP response, so after a few seconds, I'm kicked off. This problem clearly is deeper.

EDIT #2: With SoftEther I actually managed to create a bridge between the physical LAN interface and the VPN "hub" .. it's more of a hack than anything, so I don't consider this question answered yet. The real question is, what's going on with my system that it can't communicate properly with VPN clients, and why isn't it forwarding DHCP requests/responses between the client and DHCP server.

Routing tables: Client (IP connected to VPN -- I think the only relevant entries are ppp0:

Destination        Gateway            Flags        Refs      Use   Netif Expire
default             UGSc           25        0     en0
default         UGScI           1        0    ppp0
10.0.1/24          link#4             UCS             5        0     en0           0:1f:f3:43:d7:41   UHLWIir        30       85     en0    796           0:17:f2:9:4b:c4    UHLWIi          5     1953     en0   1196          UHS             0        0     lo0          b8:3e:59:dd:88:23  UHLWI           0       13     en0   1003          link#4             UHRLWI          0        6     en0         ff:ff:ff:ff:ff:ff  UHLWbI          0        5     en0           UGHS            0        0     en0
127                UCS             0        0     lo0          UH              5   661744     lo0
169.254            link#4             UCS             0        0     en0
192.168.1          ppp0               USc             2        0    ppp0       UHr             2        0    ppp0

VPN server (IP, I think the VPN interface is
C:\> route PRINT
Interface List
 10 ...68 b5 99 b0 52 18 ...... HP NC326i PCIe Dual Port Gigabit Server Adapter
 11 ...68 b5 99 b0 52 19 ...... HP NC326i PCIe Dual Port Gigabit Server Adapter
 16 ........................... RAS (Dial In) Interface
  1 ........................... Software Loopback Interface 1
 12 ...00 00 00 00 00 00 00 e0  isatap.{6392B50A-304A-42E0-89B1-16408563E929}
 15 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
 14 ...00 00 00 00 00 00 00 e0  isatap.{52FCB109-39F0-4DFD-925E-21041C3EA606}
 22 ...00 00 00 00 00 00 00 e0  Microsoft ISATAP Adapter #2

IPv4 Route Table
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
     15         On-link    306         On-link    306         On-link    306         On-link    266     24         On-link    279         On-link    266         On-link    266         On-link    306         On-link    266         On-link    279         On-link    306         On-link    266         On-link    279
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric

For the first question, if you are being assigned an IP address but can't reach internal hosts then it sounds like a routing problem. You could confirm that it's not that by trying to traceroute from the DHCP server to the VPN address you are assigned, and the other way too. Possibly there is something wrong with the routes or gateways that are being set up?

  • Yeah that's odd. I can traceroute from my client to (DHCP server, also happens to be a router that I can't run traceroute from), but not from my client to (Server 2008 running VPN) nor from that server back to my client. I'll check my routing tables and see if that gives any insight. EDIT: adding routing tables from VPN server and VPN client to my question. – Harv Aug 28 '14 at 20:56
  • Yeah weird, I'm not great with routing tables but these look fine to me. If the client has address 192.168.x and a destination address is on 192.168.x then the gateway is ppp0. That makes sense. Can you double-check that the subnets on every machine and DHCP config are the same? ( probably). Otherwise, if it's not routing then it must be permissions for VPN clients or users, no? Many VPNs will log blocked routing due to permissions.. – wrk2bike Aug 29 '14 at 3:49
  • It's funny, the VPN connection never seems to set the subnet mask. It seems to get a temporary IP and gateway. The DHCP config is good, many workstations connected happily using it, and the VPN is an odd one because I tried two different VPN apps - Server 2008's RRAS as well as SoftEther - same problem in both cases. As for permissions, I was able to before changing the DHCP server to be a hardware device on the network rather than using the Server 2008's built-in DHCP, so it's not that.. I definitely have permission. – Harv Aug 29 '14 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.