Windows Forum

Ask something
Discussion Locked

VPN IP Conflicts

0 helpful
15 replies

by lyallaust

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Connecting a PC to one network on a grouping of 10.0.0.x through to a VPN connection to a similar network also running on 10.0.0.x means we cannot establish a connection to a terminal server past the gateway on the remote network since a call to 10.0.0.3 exists on both networks.
Is there a way to specify connect to the remote network first (or exclusively)? Or any other way to connect given that both networks run TCP only, and neither can have their netmask changed.
The client PC is a Windows2000 PC behind an ISA server, connecting via VPN to a remote win2k server, then using the VPN to contact a terminal server.

15 replies

by acattr

Sad to say, but you have only two options.

One is to change the network number of one of the two networks to something else like 10.0.1.x. Your machines consider the 10.0.0.3 server as local, simply because its subnet mask tells it to send it directly to the network and not via a router.

Other option is to create a bridge between the two networks. I've never created a bridge over a vpn, it can easily be done with cisco hardware and a point to point connection. Bridging makes the two networks act like one. If you absolutely cannot change the network numbers this is the only way to do it. Also once the networks are bridged, you must make sure that there are no duplicate IP address.

Good luck.

by lyallaust

The duplicate numbers is the whole crux of the problem. ISA Publishing is the only solution i have found so far.

by jon pratt

I would think that you should simply be able to build a static route. Just use the -p switch and it should work everytime the machine boots. Microsoft has a white paper that talks about this http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/deploy/vpnscen.asp

Anyway, static routes should always take priority over any other routing tables so just make a route using the VPN straight to the terminal server that's on the remote VPN subnet. Hope this helps.

by henrywi

sorry to say but even vpn is consider local connection you shouldn't have duplicate IP address on your network, you have to change one IP address, i won't mention bridgin cuz when you do it you segmenting the network as one so best solution change the ip address

by shmaltz

IP addresses have to be unique. The only reason you don't have to pay for your IP addresses on your local network is because the class a net of 10.x.x.x is reserved for private use. What it means is that any can use it, as long as it is not public. However you still have to follow the same IP rules than the public. Which is that: every IP address on any given network has to be unique to wherever this IP address can reach. Thans why when you want an IP address that will be available for the public you have to pay for it.

by shmaltz

Definition of unique:
Pronunciation: yu-'nEk
Function: adjective
Etymology: French, from Latin unicus, from unus one -- more at ONE
Date: 1602
1 : being the only one : SOLE
2 a : being without a like or equal : UNEQUALED b : distinctively characteristic : PECULIAR 1
3 : UNUSUAL
synonymsee STRANGE
- unique?ly adverb
- unique?ness noun
usage Many commentators have objected to the comparison or modification (as by somewhat or very) of unique; the statement that a thing is either unique or it is not has often been repeated by them. Objections are based chiefly on the assumption that unique has but a single absolute sense, an assumption contradicted by information readily available in a dictionary. Unique dates back to the 17th century but was little used until the end of the 18th when, according to the Oxford English Dictionary, it was reacquired from French. H. J. Todd entered it as a foreign word in his edition (1818) of Johnson's Dictionary, characterizing it as "affected and useless." Around the middle of the 19th century it ceased to be considered foreign and came into considerable popular use. With popular use came a broadening of application beyond the original two meanings (here numbered 1 and 2a). In modern use both comparison and modification are widespread and standard but are confined to the extended senses 2b and 3. When sense 1 or sense 2a is intended, unique is used without qualifying modifiers.

by shmaltz

I included the above because it looked to me that you didn't know the definition of unique.
To your IP problem there is now workaround, it simply has to be redisigned. It's like you are trying to assign a blank IP address.

by acattr

stop trying to find off the wall solutions. In IP you can't connect two networks with the same subnet masks unless you bridge them. Change one network to 10.0.1.0/24 and forget about this nonsense.

by lyallaust

And the one solution never mentioned is to create a second IP on the network adaptor of the server connected to the VPN and the terminal server so we have effectively created a second network.

by abubin

One "trick" that you can try is to use different port for both the network. By default Terminal server uses port 3389. You can change the port by referring to Microsoft's knowledge base. With 2 different port, you can use port forwarding to forward specified ports to specified server.

Or, if you feel adventurous, you can try running one terminal server on another terminal server. That is, you connect to the first network through terminal server and then from this terminal server, connect to the other network via terminal server. This should work as I have tried nesting terminal server before and it works. I am not sure it works in your case as I can see some potential problems. Plus I have yet to experiment with VPN. I am about to do that within the coming weeks.

This discussion is closed to new replies.