2

This question could also fall under the category of networking I suppose, but I'll give it a shot here. Here's the situation:

We have web servers at work that we access using the IP Address (no domain name). For example:

http://192.168.1.12/blah.aspx

However, when I am at home, and I VPN to work (still using work computer, but VPNing through my home Internet), the above URL will not work.

It seems the reason is that it is trying to route on my private network at home. Now, I have a few ways to work around this. Primarily, I can RDP to a server at work and simply surf from there. However, I'm trying to come up with a different solution and educate myself in the process.

One of the questions that comes to mind is how the computer is making routing decisions. I thought once I was VPNd that everything would take place across this virtual adapter. Perhaps this is a split tunnel VPN?

I'm mostly interested in a solution to this issue, so that I may surf to these internal websites via the IP Address. However, I'm also interested in understanding why this happens.

Thanks!

4
  • 1
    What is your home IP range 192.168.1.x? or something else?
    – CharlesH
    Dec 22, 2014 at 14:22
  • yes, My home range is 192.168.1.x
    – Matt
    Dec 22, 2014 at 20:10
  • Yep sounds about right for having the same range on both networks (internal and VPN) the best solution would be to change your home IP range. I would need to know more about your network in general but I can assist you in doing this below in an answer. After which your local IP range can be 192.169.0.x and work 192.168.1.x to avoid any incorrectly routed traffic.
    – CharlesH
    Dec 23, 2014 at 7:57
  • I appreciate it, but I know how to change my home IP range. I guess I'm trying to understand the VPN a bit more. I thought once the VPN was connected and a "tunnel" was established that all my routing would happen via this virtual adapter. My local range shouldn't be an issue (obviously it is, though). Thanks.
    – Matt
    Dec 30, 2014 at 23:12

1 Answer 1

1

Sorry this reply was too long for a comment. In answer to your last comment:

The problem is that a routing table (in windows at least) is quite simple. (again sorry if you know this)

Windows will see an IP Range and a Subnet Mask then it has two options for where the traffic should go either a specific IP address (gateway or external address, etc) or something called on-link which means Windows will throw it to the network adapter because its a local IP address and doesn't need specific routing.

So if you have an IP range and VPN IP range that are the same you get two entries in the routing table one being 192.168.1.0 255.255.255.0 GO-TO ON-LINK and one being 192.168.1.0 255.255.255.0 GO-TO VPN-GATEWAY-IP.

Now Windows has to make a choice which one to use this is where something called the metric kicks in and is used to guide Windows on the best route to use.

So if you was to try and reach 192.168.1.12 it will go to the routing table and ask what Gateway do I need to send this traffic to get the correct response. Keeping in mind that lower metrics are of a higher priority.

The issue is that if Windows uses the VPN as the lower metric (or its higher priority route) then it will not be able to access important things like its own local Gateway or its local DNS, etc. Therefore it has to use the ON-LINK route as the lower metric (higher priority).

Hope that helps, you can view your route table in Windows by going to command prompt and typing ROUTE PRINT

3
  • Great answer. This was more what I was looking for. The interesting thing now is that I have changed everything over to 10.x.x.x, and it still doesn't work. So, I'm no longer on a local network that is 192.168.x.x. It seems unlikely, but now I'm beginning to wonder if there isn't an issue with the routing from the company's VPN subnet. I'll ask around.
    – Matt
    Jan 5, 2015 at 4:40
  • Hi Matt, sorry for delay. You mention this still is not work. There are some basic troubleshooting things you can do, for example once connected to the VPN you can load Command Prompt and firstly try to PING the IP by typing ping 192.168.1.12 if you get no response you can try TRACERT by typing tracert 192.168.1.12 this will show you the exact route that Windows is trying to get to the IP address. Happy to assist further if I can see the results of the above!
    – CharlesH
    Jan 7, 2015 at 14:02
  • Appreciate it. I tried those steps. PING fails and TRACERT never makes a single hop. As mentioned, I'm going to check with some folks internally to validate a couple of things on this side.
    – Matt
    Jan 7, 2015 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.