1

So I have an SSTP (with native Windows client) working fine in a sense. My windows client's local IP is 192.168.10.11 , so its local network is: 192.168.10.x

The Remote VPN server is behind a router and its IP address is 192.168.12.109

When I connect to the VPN server from the Windows client it makes the SSTP VPN connection just fine over port 443 and then I can ping 192.168.12.1 from the windows client. I can even connect to http://192.168.12.1 and login to the Router that control's the VPN server's LAN. I can ping and connect to any other server/pc on the VPN server's local lan, ie 192.168.12.x from my Windows vpn CLIENT which was given an IP of 192.168.12.110

The problem is that from the Windows vpn client I can NOT ping 192.168.12.109 which is the VPN server's real internal ip. Also, the VPN server can not ping 192.168.12.110 either. I've tested firewall issue, disabled all firewalls and no difference.

Some pertinent details: VPN SERVER: Softether VPN VPN SERVER: Is a Virtual Machine running under qemu-KVM, the host has br0 bridged networking. After reading some posts, I did an ifconfig eth0 promisc on the kvm HOST to enable promiscuous mode but that made no difference. But I did not yet "reboot" Host or libvirt kvm "virtual machine" which runs centos.

I do NOT have "SecureNAT" enabled on the Softether VPN server. I did create a "Local Bridge" with eth0 (interface in the kvm virtual machine which runs the vpn server). For the VirtualHUB I also disabled the setting "ManageOnlyPrivateIP" and set it to 0 so that my VPN windows client would be served a 192.168.12.x ip address. Otherwise I think it would get 192.168.30.10 from the VPN server. (strange I just gave that value back to default of 1 and my vpn client still gets 192.168.12.110 from vpn server)

When I look at the VPN connection details on the Windows VPN client, strangely its impossible to get the true IP of the VPN server. It says its 1.0.0.1 some fake dummy ip. I've read somewhere that perhaps the VPN server would give itself another arbitrary IP address in the 192.168.12.x range , (hopefully not 192.168.12.1 which is the lan IP of the internet ROUTER on the VPN server's local lan). Anyway from what I read its impossible to know what IP address in the 192.168.12.x range this Softether VPN server would assign itself since it hides its vpn network stacks, ie you can't see ppp0 etc with ifconfig like you would with strongswan openswan etc IPsec l2tp which I've used before successfully (and am still using on other servers).

htfree
  • 463
  • 4
  • 9
  • 21
  • well made some progress, I can do a local tap device ie local bridge using tap_vpn etc and run dnsmasq to give ip out and I can make a 192.168.13.x new subnet and then I can have SSTP where I can talk direct with the VPN server but then I can't talk to the rest of the PC/server on the remote local lan where VPN server is. To do that I'm back to above problem where I can do local bridge on my VPN's eth0 but then my windows vpn client can't ping or connect to the VPN server just to the other systems on that remote lan. Why can't I have both :D – htfree Apr 17 '15 at 02:59
  • Hurray, more progress. I got it to work if I manually add a route on the Windows client PC after connecting. So basically I setup SSTP VPN tunnel with local bridge on tap and setup dnsmasq etc my client would get 192.168.13.50 and the VPN server would be 192.168.13.1 and they can communicate freely between and when I added 'manually' the route for 192.168.12.x on my windows client with gateway of 192.168.13.1 then I can talk with the rest of PC/servers on the remote lan also. So works, only thing left is to see why dnsmasq and vpnbridge etc can't make do this for windows auto. on connection. – htfree Apr 17 '15 at 04:25

1 Answers1

0

SOLVED!

ANSWER:

DO NOT OVERWORK entire week long 16-18hours a day until 4:30am and expect your brain to not be FRIED! IT WAS A STUPID WINDOWS FIREWALL ISSUE!!! YES, I "THOUGHT" I had disabled it but apparently I was too sleepy to have noticed I only disabled domain and maybe outgoing but not incoming firewall!

OK, I'm going to try and get some sunlight today, guess brain needs it??!

To all the sys-admins out there, if it don't work stop banging your head and go partying a while (or sleep!), come back bit refreshed and things will work out! :)

htfree
  • 463
  • 4
  • 9
  • 21