Cannot connect to network resources through Azure point-to-site VPN

Question

Cannot connect to network resources through Azure point-to-site VPN

daviddebie 1

I have an Azure vnet with VPN gateway installed and trying to connect to the VMs that are in the network.

The root certificate is installed in Azure, the client certificate is installed on my local machine. Via the VPN client downloaded from the Portal I can connect to the VPN (so it doesn't seem to be a certificate issue).

However, every VM that I'm trying to connect to gives me a timeout, with the following message:

WarningMsg
11/17/2021 12:04:28
RDP disconnected!
516 Remote Desktop can't connect to the remote computer for one of these reasons:

Remote access to the server is not enabled
The remote computer is turned off
The remote computer is not available on the network
Make sure the remote computer is turned on and connected to the network, and that remote access is enabled.

Already checked that my computer allows remote access, also checked that the routes file of the VPN connection is complete. Double checked via ipconfig that I'm on an allocated IPv4 address.
The weird thing is, two of my coworkers can connect without any issue, using the same client certificate.
I seem to be a bit out of options now.

SaiKishor-MSFT 17,336 Reputation points

2021-11-17T19:11:54.087+00:00

@daviddebie Can you please check the effective security rules on the network interface of the machine that you are trying to reach? Here is how to verify the same.

Please share the snapshot of the effective security rules of the Network Interface of the VM in question so I can verify the same.

Please also confirm that the Antivirus is not causing any issues on this VM by turning off the same temporarily. Thank you!
daviddebie 1 Reputation point

2021-11-19T13:34:17.627+00:00

@SaiKishor-MSFT See the snapshot below, however I doubt that the problem is in those settings, since two of my coworkers can access the VMs without any issue:

As for your second question, can the Antivirus on a VM be turned off without having a remote desktop connection to the machine (since I can't get that connection)? Again I don't think it's anything in the settings of the VMs or the Network interface since it works for my coworkers.
SaiKishor-MSFT 17,336 Reputation points

2021-11-26T12:16:32.583+00:00

@daviddebie Thank you! The Inbound rules show that the traffic is allowed to the VMs inbound only from Virtual Networks and the Loadbalancer, I do not see that its allowing traffic from on-premises. Just wanted to confirm which rule allows this traffic? Do they access it using an internal LB? Please let me know.
daviddebie 1 Reputation point

2021-11-26T13:23:13.523+00:00

Hi @SaiKishor-MSFT ,

the rule that allows access to a VM is the first one, AllowVnetInBound. Local machines connect to the Virtual Network through a point-to-site connection (VPN with certificate authentication), see the documentation here: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-classic-azure-portal

Being connected to the virtual network with a local machine thus allows accessing the VMs, since the local machine is now part of the Vnet.

Hope this clarifies things.

Cheers
SaiKishor-MSFT 17,336 Reputation points

2021-12-01T11:01:48.98+00:00

@daviddebie As seen from the same document,

Subnet address range: 192.168.1.0/24
Client address space: 172.16.201.0/24
VPN clients that connect to the VNet by using this Point-to-Site connection receive an IP address from the specified pool.

Can you confirm if your co-workers connect using a P2S Client or do they connect from the vnet directly?
daviddebie 1 Reputation point

2021-12-21T12:24:41.377+00:00

@SaiKishor-MSFT

They connect via the P2S client that is downloaded from Azure (from the Virtual Network Gateway resource -> Point to site configuration -> Download VPN Client). It downloads an executable that installs the native Windows VPN with the correct configuration.
I did it exactly the same way, we went through it together multiple times, and we use the exact same Client certificate. So it has te be something on my machine that screws things up, I'm just lost here.

1 answer

Your answer

SaiKishor-MSFT 17,336 Reputation points

2021-11-17T19:11:54.087+00:00

@daviddebie Can you please check the effective security rules on the network interface of the machine that you are trying to reach? Here is how to verify the same.

Please share the snapshot of the effective security rules of the Network Interface of the VM in question so I can verify the same.

Please also confirm that the Antivirus is not causing any issues on this VM by turning off the same temporarily. Thank you!
daviddebie 1 Reputation point

2021-11-19T13:34:17.627+00:00

@SaiKishor-MSFT See the snapshot below, however I doubt that the problem is in those settings, since two of my coworkers can access the VMs without any issue:

As for your second question, can the Antivirus on a VM be turned off without having a remote desktop connection to the machine (since I can't get that connection)? Again I don't think it's anything in the settings of the VMs or the Network interface since it works for my coworkers.
SaiKishor-MSFT 17,336 Reputation points

2021-11-26T12:16:32.583+00:00

@daviddebie Thank you! The Inbound rules show that the traffic is allowed to the VMs inbound only from Virtual Networks and the Loadbalancer, I do not see that its allowing traffic from on-premises. Just wanted to confirm which rule allows this traffic? Do they access it using an internal LB? Please let me know.
daviddebie 1 Reputation point

2021-11-26T13:23:13.523+00:00

Hi @SaiKishor-MSFT ,

the rule that allows access to a VM is the first one, AllowVnetInBound. Local machines connect to the Virtual Network through a point-to-site connection (VPN with certificate authentication), see the documentation here: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-classic-azure-portal

Being connected to the virtual network with a local machine thus allows accessing the VMs, since the local machine is now part of the Vnet.

Hope this clarifies things.

Cheers
SaiKishor-MSFT 17,336 Reputation points

2021-12-01T11:01:48.98+00:00

@daviddebie As seen from the same document,

Subnet address range: 192.168.1.0/24
Client address space: 172.16.201.0/24
VPN clients that connect to the VNet by using this Point-to-Site connection receive an IP address from the specified pool.

Can you confirm if your co-workers connect using a P2S Client or do they connect from the vnet directly?
daviddebie 1 Reputation point

2021-12-21T12:24:41.377+00:00

@SaiKishor-MSFT

They connect via the P2S client that is downloaded from Azure (from the Virtual Network Gateway resource -> Point to site configuration -> Download VPN Client). It downloads an executable that installs the native Windows VPN with the correct configuration.
I did it exactly the same way, we went through it together multiple times, and we use the exact same Client certificate. So it has te be something on my machine that screws things up, I'm just lost here.

Answer 1

msrini-MSFT 9,291 Microsoft Employee

@daviddebie ,

Check if the VPN is still connected. If yes, open command prompt and "route print" and see if you are able to see the VNET route via the Gateway.

From Azure, navigate to the Destination VM and see the NIC effective routes and check if the P2S address pool route is present.

Regards,
Karthik Srinivas

Share via

Cannot connect to network resources through Azure point-to-site VPN

1 answer

Your answer