RRAS Routing Shenanigans

Question

I have A RRAS server running on an AWS VPC (10.145/24 network) with address 10.145.0.77.

I have a DHCP server/scope set up (10.250/16 network) on a separate Microsoft loopback adapter to offer DHCP Option sets to my VPN clients (RRAS server is assigned 10.250.0.5 - clients are DHCP'd 10.250.0.10 through 250).

There is also another site connected via AWS hardware VPN (192.168.168/24 network).

Everything works perfectly with the exception of one situation - VPN clients cannot ping anything on the 192.168.168/24 network (even though the RRAS server can). They ARE able to reach the 10.145/16 network without issues.

I replicated this issue by pinging test hosts on the 10.145/16 & 192.168.168/24 networks specifying the source address/adapter using the following:

Working - From VPN client network to 10.145/16

PS I:\> ping -S 10.250.0.5 10.145.11.100

Pinging 10.145.11.100 from 10.250.0.5 with 32 bytes of data:
Reply from 10.145.11.100: bytes=32 time=1ms TTL=127
Reply from 10.145.11.100: bytes=32 time=1ms TTL=127

Working - From VPC network to 192.168.168/24

PS I:\> ping -S 10.145.0.77 192.168.168.3

Pinging 192.168.168.3 from 10.145.0.77 with 32 bytes of data:
Reply from 192.168.168.3: bytes=32 time=38ms TTL=127
Reply from 192.168.168.3: bytes=32 time=39ms TTL=127

Failed - From VPN client network to 192.168.168/24

PS I:\> ping -S 10.250.0.5 192.168.168.3

Pinging 192.168.168.3 from 10.250.0.5 with 32 bytes of data:
Request timed out.
Request timed out.

And here is a traceroute demonstrating packets being properly routed to the RRAS server:

Traceroute from VPN client to 192.168.168/24

PS C:\Windows\system32> tracert 192.168.168.3

Tracing route to [redacted] [192.168.168.3]
over a maximum of 30 hops:

  1    49 ms     *       54 ms  [redacted] [10.250.0.14]
  2     *        *        *     Request timed out.

Here is the route table from the RRAS server:

PS I:\> route print
===========================================================================
Interface List
 31...........................RAS (Dial In) Interface
 16...02 00 4c 4f 4f 50 ......Microsoft KM-TEST Loopback Adapter
 12...0a 40 10 6c 77 87 ......AWS PV Network Device #0
  1...........................Software Loopback Interface 1
 14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.145.0.1      10.145.0.77    266
       10.145.0.0    255.255.255.0         On-link       10.145.0.77    266
      10.145.0.77  255.255.255.255         On-link       10.145.0.77    266
     10.145.0.255  255.255.255.255         On-link       10.145.0.77    266
       10.250.0.0    255.255.255.0         On-link        10.250.0.5    266
       10.250.0.5  255.255.255.255         On-link        10.250.0.5    266
      10.250.0.13  255.255.255.255      10.250.0.13      10.250.0.14     31
      10.250.0.14  255.255.255.255         On-link       10.250.0.14    286
     10.250.0.255  255.255.255.255         On-link        10.250.0.5    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  169.254.169.250  255.255.255.255       10.145.0.1      10.145.0.77     10
  169.254.169.251  255.255.255.255       10.145.0.1      10.145.0.77     10
  169.254.169.254  255.255.255.255       10.145.0.1      10.145.0.77     10
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.250.0.5    266
        224.0.0.0        240.0.0.0         On-link       10.145.0.77    266
        224.0.0.0        240.0.0.0         On-link       10.250.0.14    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.250.0.5    266
  255.255.255.255  255.255.255.255         On-link       10.145.0.77    266
  255.255.255.255  255.255.255.255         On-link       10.250.0.14    286
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0       10.145.0.1  Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 16    266 fe80::/64                On-link
 12    266 fe80::/64                On-link
 16    266 fe80::adb9:e96f:8722:b496/128
                                    On-link
 12    266 fe80::c4b0:bebf:ed1b:fecf/128
                                    On-link
  1    306 ff00::/8                 On-link
 16    266 ff00::/8                 On-link
 12    266 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

I think you will need a static route in RRAS for the 192 network. I had a similar situation where the gateway for the RRAS server had a route to another subnet but the packets never got to the gateway. Once I added the route everything worked — Drifter104, May 26 '15 at 22:32
@MichaelLewis I just wiresharked my adapter on the RRAS server and I am seeing ICMP on the wire outbound from 10.250.0.13=>192.168.168.3. I think there is something much more dire in store for me than a routing table problem... — , May 26 '15 at 23:04

RRAS Routing Shenanigans

0 Answers0