Question : VPN connection conflict

We have a VPN concentrator that bring external folks into the inside with a 10.0.0.0/16 IP address.  It seems that when a person VPNs in, and their internal LAN connection, in their home, is a 10.0.0.0 network, they are unable to go anywhere else within my network.  I am pretty sure it is because of the two networks being the same.

Is there a work around from the client side without having to change their internal LAN network?

People are using the standard VPN connection in Windows to connect.

Answer : VPN connection conflict

dazman,
No, you can't untick "Use ... Default Gateway" - doing that will define a network route for the RAS connection, which will supersede the LAN route, that will reverse the situation - the remote network is available, but the LAN is no longer.

This can only be done with a trick, and only if there are no conflicting addresses.
  • Create permanent routes on the dialing-in host (only needed once):
     
route -p add 0.0.0.0 mask 128.0.0.0 LocalGatewayHere
route -p add 128.0.0.0 mask 128.0.0.0 LocalGatewayHere
  • Dial in with "Use remote gateway" enabled 
  • manually set routes to the remote network, as specific as necessary and generic as possible. If the networks are different enough, you can use network routes, else set up host routes. E.g. 
route add 10.0.0.200 IF 0x4000

The number following IF is the virtual interface number used for RAS, which you get with route print in the header. Finding the gateway and interface number can be automated with a batch script.

As you can see, it is rather tricky and inconvenient.
If you use different IP addresses for the RAS connection, 192.168.238.0/24 for example, it will be easier - you won't need "use remote gateway", and only specific routes to the remote network as shown above. Not much of difference, though.

If the folks dialing in are using 10.x networks, I suppose they are companies, which can use a Windows Server (2003 or better)? If so, there is a much more convenient way of just setting up RRAS in routing mode on that server, and define local routes as needed and shown above, but with the RRAS server as gateway (which is static and on the network, so routes don't get lost if the RAS connection is interrupted).

Random Solutions  
 
programming4us programming4us