I have the following setting going on.
Server: Configured windows 2008 server as AD, DHCP, DNS, CA and RRAS. To make long story short, RRAS can accept SSTP connection and clients get connected fine. Clients get IP address.
Client: Windows 7 OS
Configuration:
I have a linux firewall at the perimeter. The port has been opened to forward 443 to an internal IP address and port on the RRAS server.
The private network is on a 10.100.0.0/16 subnet.
RRAS server has 2 NIC. NIC1=10.100.85.15 and NIC2=10.100.85.16. NIC2 is accepting SSTP connections from the public internet. The adapter settings on NIC2 only has the static IP and subnet. No gateway and DNS servers are configured on NIC2 (this I did based on something I read somewhere regarding setting up PPTP on Windows 2003). NIC1 has the top priority out of the 2 NICs.
RRAS has been setup for VPN only (no NAT). The IP address allocation is static and it is from the pool of 10.100.77.250 to 10.100.77.254 (the same subnet as the private network).
I have allowed ICMP any on either direction in the inbound and outbound filters.
Windows Firewall has been configured to allow pretty much everything – and then at this configuration I have turned off the Windows Firewall Service.
I have not added any static routes to RRAS.
As mentioned earlier, the VPN client is able to connect to RRAS over SSTP and get and IP address. Client is able to ping the RRAS gateway (10.100.77.250), NIC1 and NIC2.
Issue:
The client cannot ping to any machine other than the RRAS server
More Debug Information:
I installed Microsoft Network Monitor on RRAS server to monitor the ICMP packets. I do see the ICMP request going from client (say 10.100.77.251) to RRAS to destination server (say 10.100.20.10), and 10.100.20.10 responds with ICMP reply back to 10.100.77.251 with ethernet address of NIC1. At this point, here is the routing table from the RRAS server.
===========================================================================
Interface List
12 ...7a dd d0 eb af 8c ...... Citrix PV Ethernet Adapter #0
13 ...7e ab 6f 21 e8 30 ...... Citrix PV Ethernet Adapter #1
26 ........................... RAS (Dial In) Interface
1 ........................... Software Loopback Interface 1
14 ...00 00 00 00 00 00 00 e0 isatap.{BCF77165-229C-410C-AE43-D71B6D902F6A}
27 ...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
15 ...00 00 00 00 00 00 00 e0 isatap.{4705FD1E-0998-43A4-9EBE-46776B90B205}
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.100.0.1 10.100.85.15 356
10.100.0.0 255.255.0.0 On-link 10.100.85.15 356
10.100.0.0 255.255.0.0 On-link 10.100.85.16 358
10.100.77.253 255.255.255.255 10.100.77.253 10.100.77.254 31
10.100.77.254 255.255.255.255 On-link 10.100.77.254 286
10.100.85.15 255.255.255.255 On-link 10.100.85.15 356
10.100.85.16 255.255.255.255 On-link 10.100.85.16 358
10.100.255.255 255.255.255.255 On-link 10.100.85.15 356
10.100.255.255 255.255.255.255 On-link 10.100.85.16 358
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.100.85.16 358
224.0.0.0 240.0.0.0 On-link 10.100.85.15 356
224.0.0.0 240.0.0.0 On-link 10.100.77.254 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.100.85.16 358
255.255.255.255 255.255.255.255 On-link 10.100.85.15 356
255.255.255.255 255.255.255.255 On-link 10.100.77.254 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.100.0.1 Default
0.0.0.0 0.0.0.0 10.100.0.1 Default
0.0.0.0 0.0.0.0 10.100.0.1 Default
===========================================================================
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
13 266 fe80::/64 On-link
12 266 fe80::/64 On-link
12 266 fe80::a8b1:77f:5eb0:d5a8/128
On-link
13 266 fe80::f8a0:2a9d:bee9:e688/128
On-link
1 306 ff00::/8 On-link
13 266 ff00::/8 On-link
12 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
I know there is some routing issue…and I have tried all combinations to insert a route add in the RRAS but nothing works. Any help is greatly appreciated.
Update: Converted the AD machine to a single NIC configuration. Here is the routing table on client and RRAS when the Client is connected.
===========================================================================
Interface List
12 ...7a dd d0 eb af 8c ...... Citrix PV Ethernet Adapter #0
22 ........................... RAS (Dial In) Interface
1 ........................... Software Loopback Interface 1
23 ...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
14 ...00 00 00 00 00 00 00 e0 isatap.{4705FD1E-0998-43A4-9EBE-46776B90B205}
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.100.0.1 10.100.85.15 356
10.100.0.0 255.255.0.0 On-link 10.100.85.15 356
10.100.77.252 255.255.255.255 10.100.77.252 10.100.77.254 31
10.100.77.254 255.255.255.255 On-link 10.100.77.254 286
10.100.85.15 255.255.255.255 On-link 10.100.85.15 356
10.100.255.255 255.255.255.255 On-link 10.100.85.15 356
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.100.85.15 356
224.0.0.0 240.0.0.0 On-link 10.100.77.254 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.100.85.15 356
255.255.255.255 255.255.255.255 On-link 10.100.77.254 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.100.0.1 Default
0.0.0.0 0.0.0.0 10.100.0.1 Default
0.0.0.0 0.0.0.0 10.100.0.1 Default
===========================================================================
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
12 266 fe80::/64 On-link
12 266 fe80::a8b1:77f:5eb0:d5a8/128
On-link
1 306 ff00::/8 On-link
12 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
Client
===========================================================================
Interface List
23...........................VPN
10...08 00 27 e9 14 91 ......Intel(R) PRO/1000 MT Desktop Adapter
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.123.2 192.168.123.15 10
10.0.0.0 255.0.0.0 10.100.77.254 10.100.77.252 11
10.100.77.252 255.255.255.255 On-link 10.100.77.252 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.123.0 255.255.255.0 On-link 192.168.123.15 266
192.168.123.15 255.255.255.255 On-link 192.168.123.15 266
192.168.123.255 255.255.255.255 On-link 192.168.123.15 266
216.218.195.214 255.255.255.255 192.168.123.2 192.168.123.15 11
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.123.15 266
224.0.0.0 240.0.0.0 On-link 10.100.77.252 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.123.15 266
255.255.255.255 255.255.255.255 On-link 10.100.77.252 266
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
1 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
Best Answer
Two things I noticed. 1) AD should never have more than one NIC. A multi-homed DC is not supported by MS. But I don't think that's causing your problem. 2) You turned off the Windows Firewall Service. Probably not a good idea. Try turning the service back on and running the following command to disable the profiles.
I'm still not sure if this will solve your problem, but those two things jumped out at me.