0

Alright, I have a Windows 2008 server running. It serves up DNS but not DHCP. I want to have VPN running on it, and my understanding is that you can do this as long as you set the DHCP relay server properly.

I've added the 'internal' and 'LAN' interfaces to the DHCP relay agent and enabled forwarding on both interfaces. When I connect in, I do get an IP address but if I watch the logs, its sending out broadcast messages looking for a DHCP server, but not getting anything back.

When I check the DDHCP relay agent, it looks like its discarding all of my requests, and either not forwarding them on to the DHCP server, or not sending them back to the client (I can't tell which).

My first question is, how can I make that work, what am I missing?

The second question is, can I run OpenVPN on the server and achieve the same result, but also have it tie in to ActiveDirectory for authentication?

EDIT #1: With regards to the above (question #2) I actually installed SoftEther VPN, configured it for L2TP and had it authenticating against ActiveDirectory. Everything went great, except I ran into the same problem: I can establish a connection briefly from my laptop to the VPN server, but get no DHCP response, so after a few seconds, I'm kicked off. This problem clearly is deeper.

EDIT #2: With SoftEther I actually managed to create a bridge between the physical LAN interface and the VPN "hub" .. it's more of a hack than anything, so I don't consider this question answered yet. The real question is, what's going on with my system that it can't communicate properly with VPN clients, and why isn't it forwarding DHCP requests/responses between the client and DHCP server.

Routing tables: Client (IP 192.168.1.21) connected to VPN -- I think the only relevant entries are ppp0:

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            10.0.1.1           UGSc           25        0     en0
default            192.168.1.24       UGScI           1        0    ppp0
10.0.1/24          link#4             UCS             5        0     en0
10.0.1.1           0:1f:f3:43:d7:41   UHLWIir        30       85     en0    796
10.0.1.2           0:17:f2:9:4b:c4    UHLWIi          5     1953     en0   1196
10.0.1.11          127.0.0.1          UHS             0        0     lo0
10.0.1.26          b8:3e:59:dd:88:23  UHLWI           0       13     en0   1003
10.0.1.32          link#4             UHRLWI          0        6     en0
10.0.1.255         ff:ff:ff:ff:ff:ff  UHLWbI          0        5     en0
96.53.59.18        10.0.1.1           UGHS            0        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              5   661744     lo0
169.254            link#4             UCS             0        0     en0
192.168.1          ppp0               USc             2        0    ppp0
192.168.1.24       192.168.1.21       UHr             2        0    ppp0


VPN server (IP 192.168.1.250, I think the VPN interface is 192.168.1.24):
C:\> route PRINT
===========================================================================
Interface List
 10 ...68 b5 99 b0 52 18 ...... HP NC326i PCIe Dual Port Gigabit Server Adapter
 11 ...68 b5 99 b0 52 19 ...... HP NC326i PCIe Dual Port Gigabit Server Adapter
#2
 16 ........................... RAS (Dial In) Interface
  1 ........................... Software Loopback Interface 1
 12 ...00 00 00 00 00 00 00 e0  isatap.{6392B50A-304A-42E0-89B1-16408563E929}
 15 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
 14 ...00 00 00 00 00 00 00 e0  isatap.{52FCB109-39F0-4DFD-925E-21041C3EA606}
 22 ...00 00 00 00 00 00 00 e0  Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.250     15
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.250    266
     192.168.1.21  255.255.255.255     192.168.1.21     192.168.1.24     24
     192.168.1.24  255.255.255.255         On-link      192.168.1.24    279
    192.168.1.250  255.255.255.255         On-link     192.168.1.250    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.250    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.250    266
        224.0.0.0        240.0.0.0         On-link      192.168.1.24    279
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.250    266
  255.255.255.255  255.255.255.255         On-link      192.168.1.24    279
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.1.1       5
===========================================================================
0

For the first question, if you are being assigned an IP address but can't reach internal hosts then it sounds like a routing problem. You could confirm that it's not that by trying to traceroute from the DHCP server to the VPN address you are assigned, and the other way too. Possibly there is something wrong with the routes or gateways that are being set up?

  • Yeah that's odd. I can traceroute from my client to 192.168.1.1 (DHCP server, also happens to be a router that I can't run traceroute from), but not from my client to 192.168.1.250 (Server 2008 running VPN) nor from that server back to my client. I'll check my routing tables and see if that gives any insight. EDIT: adding routing tables from VPN server and VPN client to my question. – Harv Aug 28 '14 at 20:56
  • Yeah weird, I'm not great with routing tables but these look fine to me. If the client has address 192.168.x and a destination address is on 192.168.x then the gateway is ppp0. That makes sense. Can you double-check that the subnets on every machine and DHCP config are the same? (255.255.255.0 probably). Otherwise, if it's not routing then it must be permissions for VPN clients or users, no? Many VPNs will log blocked routing due to permissions.. – wrk2bike Aug 29 '14 at 3:49
  • It's funny, the VPN connection never seems to set the subnet mask. It seems to get a temporary IP and gateway. The DHCP config is good, many workstations connected happily using it, and the VPN is an odd one because I tried two different VPN apps - Server 2008's RRAS as well as SoftEther - same problem in both cases. As for permissions, I was able to before changing the DHCP server to be a hardware device on the network rather than using the Server 2008's built-in DHCP, so it's not that.. I definitely have permission. – Harv Aug 29 '14 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.