guess
Hi,
I've just installed the ESXi Virtual Appliance version.
I have two network interfaces; ens192 which is external web facing and ens32 which is internal safe LAN facing. I am Listening on ens192. In the console or SSH, I can ping anything on either network, however if I connect via the VPN (on a windows 7 pro 64bit client) I can not ping anything on the ens32 internal subnet. I can ping things on the ens192 "DMZ" subnet.
The weird thing is, I CAN ping things on other "internal" subnets I have. Things where the only route to get to them is a router on the default internal subnet on ens32 where I can't ping anything (they're actually other offices subnets). These other subnets are defined in the /etc/network/interfaces config file with route adds and the gateway (that exists on the ens32 interface's subnet). There is no route for the ens32 default subnet in the interfaces file, because well it's already on that subnet.
My current VPN Settings via the GUI are for VPN clients to have access to private subnets using NAT and I've listed all the subnets I want access to in the box below, including the default one on my internal network interface called ens32.
I'm historically a windows man with very little linux experience. We have an old MS ISA server running our VPN at the moment for about 120 users, I was hoping to replace it with this once I know I can get it to do everything I need. One of those things is LDAP integration, but I can't even talk to my safe subnet yet to try that 🙂 I have tried "tinkering" with help from google for the past couple of days, but I'm at the point now where I'm going round in cicrlces.
Any ideas to try?
Thanks
The Johan
I'd try installing tcpdump and running it like so;
apt-get install tcpdump
tcpdump -eni any icmp
Now do ping tests from a connected VPN client to a target machine in the subnet you cannot reach. Do you see an echo request coming in from the VPN client, and do you see the echo request being forwarded? If so, then the Access Server looks like it's doing its job and it could be a matter of having to add the Access Server IP as a gateway to the VPN subnet, or setting things up to use NAT instead of routing, or some such thing.
guess
[SOLVED]
cheers for the suggestion, i actually had started using tcpdump (it's actually on the VM by default) to see if my pings were going through and they were showing up on my internal NIC ens32.
anyway, i've spent the day trying things, looking at routing tables on the client PC's, looking at iptables, checking IP addresses and masks, tinkering with bits in the GUI. The last thing I did was try move everything from NAT to Routing, but this didn't seem to work, so I went back to NAT and hey presto it's all started working.
no idea why, not sure what it was ... as far as i can tell, i've put the config back to exactly what it was yesterday when it wasn't working.
oh well 🙁
The Johan
I blame aliens. Or perhaps not clicking 'update running servers' after saving settings. That or aliens.
guess
i had noticed on some changes when you caused a clash in settings (e.g. define a subnet in one place that clashed with an existing one or put weird things in the server (e.g. i was playing with push route-metrics) box and could cause error messages) that things didn't save - and from then on, even if you do get the setting right it wouldn't save so time for a reboot.
also noticed sometimes settings didn't take effect even if you know they got saved and applied to the current server unless you rebooted the entire server (fortunately on a quick VM, this was very easy to do).
also, don't always rely on the automatic disconnect of the vpn client to reconnect and pick up new settings.
there's so many things so yes, i was very aware that there's a probability between the things above and maybe missing a step or two in applying new settings that it could have simply been that.
but aliens ...
🙂 😉
