VPN (RRAS) on a /23 network.

Question

Subject: Windows server 2022 Stn. Ed. - VPN (RRAS) SSTP Not NAP capable setup.

Setting up this VPN I discovered an issue that I would like to resolve. I have a DHCP and AD Site set up with a /23 network. Our DHCP has a scope of 129.168.0.0/23 and we have excluded the 192.168.0.0/24 from distribution, leaving the 192.168.1.0/24 for leases. When I set up the VPN with SSTP everything went well except that the clients receiving an address from the 192.168.1.0/24 range could not access any of our resources in the 192.168.0.0/24 range, even though our subnet from the DHCP server is 255.255.254.0.

The question is how to we get the VPN client to "see" the entire /23 network? NOTE: adding a static route in the IPv4 section of the VPN service did not resolve this issue.

My forced workaround was to carve out 15 addresses in the 192.168.0.0/24 range and have the VPN use them in a static pool for the VPN Clients so that they could access our DFS, DNS and other resources because those resources are all in that 129.168.0.0/24 range.

This obviously does not effect my LAN clients as they all have the correct subnet information and happily work in that 192.168.0.0/23 network.

I have a feeling someone is going to tell me to configure IPv6 to overcome this issue, but that is not the answer I am looking for...

Answer 1

Hello @Johan Pingree

Your server is pushing route to 192.168.0.0/23 but that overlaps with your local subnet of 192.168.1.0/24. On most systems both routes can co-exist but the one with lower prefix will get preference. So the 192.168.1.0/24 range will continue to get routed to the local LAN

try adding to the client config file the next setting:

push "redirect-gateway block-local"

Hope this helps with your query,

-----------

--If the reply is helpful, please Upvote and Accept as answer--