Routing through VPN tunnel

[lorenzodv]

Please help me: this problem is driving me crazy.
I have two subnets: 192.168.1.0 and 192.168.2.0 connected through a pubblic
WAN.
I successfully enstabilished a VPN tunnel between 192.168.1.1 and
192.168.2.1.

Virtual addresses are the following:
192.168.1.1 10.0.0.1 VPN server
192.168.2.1 10.0.0.2 VPN client

Now, to join the two LANs, I need to route the subnet on the other end
thourgh the tunnel, right?
So...

route add 192.168.1.0 mask 255.255.255.0 10.0.0.2
(on the VPN client - works fine)

route add 192.168.2.0 mask 255.255.255.0 10.0.0.1
(on the VPN server - DOES NOT WORK)
(error: Parameter is incorrect)

Why Windows won't let me add the latter route? It would just send all the
traffic directed to the other subnet on the VPN interface, 10.0.0.1.
It seems I can't add routes through the 10.0.0.1 interface, no matter what
destination I'm trying to route and I can't find a reason for this!

I'm using Windows XP Pro SP1.

Thanks!

 

[bobbytupper]

Here is a link that might get you up and running - it's all on there !

http://www.microsoft.com/windows200...indows2000/en/server/help/sag_rras-ch4_41.htm

 

[lorenzodv]

YES, I was finally able to figure it out. Since the RRAS server is a point-multipoint interface, I need to route through the next hop on the connection, not through the local interface.

route add 192.168.1.0 mask 255.255.255.0 10.0.0.2
(on the VPN client - works fine)

route add 192.168.2.0 mask 255.255.255.0 10.0.0.2
(on the VPN server - FINALLY works fine too)

I was decieved by the fact that a PPTP connection is a point-to-point interface, and I forgot that the RRAS interface is able to enstabilish multiple concurrent connections, so it is a point-multipoint interface.

I still have a couple more doubts:

- The route I added can't be static, because the client IP address does exist only during connection. Is there an automatic way to have Windows run some kind of script executing the "route add" command each time an inbound PPTP connection is accepted?

- Second, the above routes work only with unicast traffic. What destination should I specify to route multicast and broadcast packets? Will them affect broadcast routing on the local LAN?

Thanks in advance for your precious help.

 

[bobbytupper]

I think what you are trying to do would work much better using the ipsec protocol - is this an option ?

 

[lorenzodv]

Weel, I don't want to mess up with certificates and security, but just to have two simple LANs working together.

I had ALREADY estabilished the tunnel, now I must overcome some routing issues. Multicast traffic is directed to 255.255.255.255, but Windows does not want me to add a route for this destination. That's strange, because a route like that is alredy addes, pointing to the LAN card interface.

 

[bobbytupper]

What kind of multicast traffic do you want routed over the vnp tunnel.

 

[lorenzodv]

I think it is broadcast in this case, so the destination address would be 255.255.255.255/32, but as I said, Windows won't let me add a route for this address, although one exists:

255.255.255.255 255.255.255.255 192.168.0.1

192.168.0.1 is the LAN address: obviously Windows is routing all the broadcasts on the LAN. What I would like to add is:

255.255.255.255 255.255.255.255 10.0.0.2

Where 10.0.0.2 leads through the VPN tunnel.
But this doesn't seem to work... maybe I need to set 10.0.0.2 ad the default router (0.0.0.0) ?

Thanks.

 

[bobbytupper]

But I mean why do you want to try and route broadcast traffic over your vpn tunnel ?

 

[Brionbel]

You might try a directed broadcast to your remote LAN. Instead of routing all broadcasts, use the broadcast destination 192.x.y.255 /32 through the WAN.

 

[lorenzodv]

It would be great if I could direct broadcast. However, there are some office applications as well as some games that broadcast to 255.255.255.255 by design and I can't change it.

The strange thing now is this: WHY am I not able to add a route for 255.255.255.255/32 through 10.0.0.2? It would be exactly the same as the route for 255.255.255.255/32 through 192.168.0.1 that Windows adds when installing a NIC.