Networks

Ask something
Discussion Locked

Unable to browse subnets using VPN

0 helpful
9 replies

by phingers 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

VPN between 2 W2000 servers using Cisco 827-4V routers. Both servers can browse the internet. One server can browse the entire network. W98 DHCP clients can log on over the VPN and connect to the mail server located on the other side. None of them can browse the network or the Internet. I have checked the gateway and it is set correctly and also tried setting this and DNS manually but still the same. One XP client can browse the network but still no Internet access.
Any ideas welcome?

9 replies

by acattr

Network Browsing on 98 clients relies heavily on broadcasting. As far as I know W2000 RRAS doesnt support broadcasting over vpns. You can try to implement WINS to see if it helps.

As far as the internet issue. i think you have a routing problem. try to ping an ip address on the internet(216.239.35.101) from a workstation. try to ping a site address like www.google.com. they will probably both fail if you have a routing issue. You can use tracert to see at what router the connection is failing. And from the server use tracert to see how it is going over the internet.

have you tried to make the cisco 827-4V router the default gateway to see if you can see the internet. If it works, you may need to add a route in teh 827-4V to forward packets designated for the otherside of the VPN to go to the w2000 server. You can also do this from the client with a "route add 192.168.2.0 mask 255.255.255.0 192.168.1.2." Where 192.168.2.0 is the other network over the vpn, and 192.168.1.2 is the w2000 vpn box.

by phingers

WINS is already implemented and working.
From a client I cannot ping an internet address or name. tracert only goes as far as the client gateway which is the W2000 server. Both servers can get to the internet fine.
I tried setting therouter as the default gateway on the client but still no internet.

Thanks for the info on W2000 RRAS broadcasting over vpns, I'll check it out

by acattr

so what happens on the W98 machines when you do a "tracert 216.239.35.101" and the gateway is the default router? 216.239.35.101 is www.google.com. If you reject this answer, atleast put the tracert results in your comments, so we can all see what happens.

It could be that your vpn server is using the vpn session to browse the internet. It doesn't make sense, if the w2000 vpn box can surf the w98 machines should be able to surf too if they have the same gateway. If the w98's still can'tsurf, call your ISP.

PS: I hope you don't have proxy client installed on the w98 machines.

by phingers

There is no proxy client installed.

I have found that I cannot ping the router when the gateway is set on the W98 clients. tracert does not get anywhere - hence no results to post. I think this may be because the router has a different subnet mask?

The W2000 server is multihomed. The external interface connects to the router and has this as its gateway, which then connects to the internet.

The LAN interface does not have a gateway set and the W98 clients using DHCP receive the W2000 server as the default gateway. If I do route print there is no default gateway shown on these clients.

by acattr

You didnt mention that the router was on a different subnet. This changes everything. You need to enable NAT on the 2000 box, this will allow sharing of the internet connection.

make the 2000 box the default gateway on all workstations.

from the server go to start --> administrative tools --> routing and remote access. right click your server and click "configure and enable...", next, internet connection server, setup a router..., next, select the internet interface, next, finish.your done.

PS: this will work, but the best solution is to get a real firewall that can handle the vpn.

by phingers

Routing and remote accesss is already enabled.

We have the Cisco routers as a hardware firewall?

by acattr

You only have two options:

1. Enable NAT in RRAS on the multihomed 2000 box.
2. Put the cisco on the same network as the workstations.

You decide.

by phingers

Thanks for all your help. We have enabled NAT in the RRAS on the multihomed W2000 servers, although we needed to patch the routers straight into the switches rather than the W2000 boxes. This allows us to browse the network also.

This discussion is closed to new replies.