Problems setting up VPN using Windows NT 4 in a router environment

Hello,



I'm having trouble configuring my network in such a way, that it would allow
me to connect to client machines within my network after connecting a remote
computer VPN.



This is my setup:



1. A linksys router connects to the internet as well as to all of my client
machines. The router acts as a DHCP server and assigns IP adresses of subnet
255.255.255.0 starting at 192.168.1.100



2. There is a Windows NT Server,called fifi, in my network that allows
incoming VPN connections. The server has a static private IP address of
192.168.1.150 and is configured as the DMZ host.



3. I can ping and connect to the server with the client machines and vice
versa.



4. The Windows NT server also allows incoming PPTP VPN connections. The VPN
server assigns IP addresses to remote clients in the range 192.168.1.21 to
192.168.1.25. To connected remote clients, the VPN server has the address
192.168.1.20



Now, when I connect a remote client via VPN, the connection is established
without any problems and the client gets assigned the IP address of
192.168.1.21 (e.g.). However, while working from the connected client, I am
not able to ping ANYTHING but the client's own IP adress. It doesn't even
find 'fifi' when I try to ping it. Even if I try to ping the IP address
192.168.1.20 or 192.168.1.1 directly, I get no response.



Does anybody know if and how I have to set up special routes for this to
work correctly?



Any help is very much appreciated.



Kind Regards,





Rudy.

Sounds like a pathing problem with the route back. This is were the packets are getting to the target but the target can't reply back

I would recommend doing a Trace Route (TRACERT) from both directions. I suspect both will fail but at different points

Don't forget you will need to use the VPN tunneled address not the VPN network addresses

Once you isolate down what route table needs to be manually corrected you should be fine.

There are some comments that don't make sense to me. Continued below...

"Rudy" <(E-Mail Removed)> wrote in message
news:MqVoc.471999$Ig.238694@pd7tw2no...
> 2. There is a Windows NT Server,called fifi, in my network that allows
> incoming VPN connections. The server has a static private IP address of
> 192.168.1.150 and is configured as the DMZ host.

How can it be a "DMZ Host" when there isn't a DMZ?

> 4. The Windows NT server also allows incoming PPTP VPN connections. The
VPN
> server assigns IP addresses to remote clients in the range 192.168.1.21 to
> 192.168.1.25. To connected remote clients, the VPN server has the address
> 192.168.1.20

In #2 you said its IP# was 192.168.1.150, now you say it is
192.168.1.20,....which is it? You refered to both as being the machine that
accepts the VPN connections?

> 192.168.1.21 (e.g.). However, while working from the connected client, I
am
> not able to ping ANYTHING but the client's own IP adress. It doesn't even
>
> Does anybody know if and how I have to set up special routes for this to
> work correctly?

Routing only occurs between subnets, not hosts. Since you only have one
subnet (192.168.1.x), and the VPN "caller" becomes part of that same subnet
(192.168.1.21--25) there is nothing to route to or from,...so there just
isn't any routing involved.

Use the following article to verify that you have setup the RRAS/VPN Server
to properly work with a Remote Access VPN type of connection.

Virtual Private Networking with Windows 2000: Deploying Remote Access VPNs
http://www.microsoft.com/windows2000.../vpndeploy.asp

Here are some other articles of interest...

Microsoft Windows Server 2003 Remote Access/VPN Server Role
http://www.microsoft.com/technet/pro...r/default.mspx

Overview of Deploying Dial-up and VPN Remote Access Servers
http://www.microsoft.com/resources/d...rv/2003/all/de
ployguide/en-us/dnsbf_vpn_mcnx.asp


--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com