<div>
It's not that simple as 143.174.88/24 not being routed over VPN (on client)?<br />

</div>


<div>
I need remote access to the devices - routing 143.174.88/24 outside of the vpn tunnel will mean I have to allow ANY IP to access the 143.174.88/24 devices for remote access. I want to access all devices via VPN tunnel only, from any IP. 
</div>


<div>
One more thing - all VPN clients are assigned 192.168.0.xx via DHCP. Server can ping to 143.174.88/24 but clients cannot. Clients are able to access anything on the network except devices on the public subnet of the vpn server (143.174.88/24).<br />
<br />
Hope u guys can help, this will solve a lot of security issues.
</div>


<div>
I reckon you configured your 143,174,88/24 route correctly as would <br />
&nbsp; &nbsp; <i>route add 143.174.88.0 mask 255.255.255.0 192.168.0.8</i><br />
on client. Your VPN should have established an host route for the gateway 143.174.88.30, so no interfering.<br />
<br />
If you ping from server, it will be from 143... to 143... =&gt; no routing, same network. From VPN client it will be 192.168.0.x to 143..., and this is routing. As your VPN gateway is not your default router, it will not be used for local clients, I assume.<br />
<br />
I suggest you try a traceroute &nbsp;either from &nbsp;VPN client or local client, with Loose Source Route option. E.g. for VPN client: <i>tracert -j 192.168.0.251 143.174.88.x.<i> </i></i>This should follow the path 192.168.0.x =&gt; 192.168.0.8 0 =&gt; 192.168.0.251 =&gt; 143.174.88.x<br />
<i><i></i><br />
</i>
</div>


<div>
Here is what I got: <br />
C:\Windows\system32&gt;tracer<wbr />t -j 192.168.0.251 143.174.88.1<br />
<br />
Tracing route to router.ite.net [143.174.88.1]<br />
over a maximum of 30 hops:<br />
<br />
&nbsp; 1 &nbsp; &nbsp;42 ms &nbsp; &nbsp;31 ms &nbsp; &nbsp;31 ms &nbsp;SRVHARD003 [192.168.0.120]<br />
&nbsp; 2 &nbsp; &nbsp; * &nbsp; &nbsp; &nbsp; &nbsp;* &nbsp; &nbsp; &nbsp; &nbsp;* &nbsp; &nbsp; Request timed out.<br />
&nbsp; 3 &nbsp; &nbsp; * &nbsp; &nbsp; &nbsp; &nbsp;* &nbsp; &nbsp; &nbsp; &nbsp;* &nbsp; &nbsp; Request timed out.<br />
&nbsp;....<br />
This has always been the case. BTW, 192.168.0.120 is the Internal IP Address. I removed all the settings again and tried to ping another internet server but different subnet:<br />
<br />
C:\Windows\system32&gt;tracer<wbr />t 205.230.132.96<br />
Tracing route to 205.230.132.96 over a maximum of 30 hops<br />
<br />
&nbsp; 1 &nbsp; &nbsp;42 ms &nbsp; &nbsp;39 ms &nbsp; &nbsp;47 ms &nbsp;SRVHARD003 [192.168.0.120]<br />
&nbsp; 2 &nbsp; &nbsp;39 ms &nbsp; &nbsp;39 ms &nbsp; &nbsp;31 ms &nbsp;192.168.0.251<br />
&nbsp; 3 &nbsp; 107 ms &nbsp; &nbsp;30 ms &nbsp; &nbsp;31 ms &nbsp;router.xxx.net [143.174.88.1] &lt;&lt;&lt;&lt;&lt;&lt;&lt;<br />
&nbsp; 4 &nbsp; &nbsp;27 ms &nbsp; &nbsp;31 ms &nbsp; &nbsp;23 ms &nbsp;143.174.88.26<br />
&nbsp; 5 &nbsp; &nbsp;37 ms &nbsp; &nbsp;23 ms &nbsp; &nbsp;39 ms &nbsp;205.230.132.96<br />
<br />
Trace complete.<br />
<br />
But a direct ping is:<br />
C:\Windows\system32&gt;tracer<wbr />t 143.174.88.1<br />
<br />
Tracing route to router.ite.net [143.174.88.1]<br />
over a maximum of 30 hops:<br />
<br />
&nbsp; 1 &nbsp; &nbsp;27 ms &nbsp; &nbsp;30 ms &nbsp; &nbsp;55 ms &nbsp;SRVHARD003 [192.168.0.120]<br />
&nbsp; 2 &nbsp; &nbsp; * &nbsp; &nbsp; &nbsp; &nbsp;* &nbsp; &nbsp; &nbsp; &nbsp;* &nbsp; &nbsp; Request timed out.<br />
&nbsp; 3 &nbsp; &nbsp; * &nbsp; &nbsp; &nbsp; &nbsp;* &nbsp; &nbsp; ^C<br />

</div>


<div>
I've got the impression your LAN gateway 192.168.0.251 is causing this behaviour. I would like you to try the same traceroutes from a local client without direct link to 143.xx.<br />
<br />

</div>


<div>
Solved it. <br />
<br />
Only the public interface has a default gateway, none for the private int which is applicable to most situations with only one route to the internet. <br />
<br />
Solution was to remove default gateway on public int and set default gateway to LAN router via private interface &nbsp;and include a static route to the 143.xx subnet to route to the default gateway. &nbsp;Metric has to be higher than 1 so that it does not override the 143.174.88.30 address for the public interface.<br />
<br />
C:\Users\Oliver.Cerbo.ITEH<wbr />Q&gt;tracert 12.174.88.1<br />
<br />
Tracing route to router.xxx.net [143.174.88.1]<br />
over a maximum of 30 hops:<br />
<br />
&nbsp; 1 &nbsp; &nbsp;24 ms &nbsp; &nbsp;30 ms &nbsp; &nbsp;31 ms &nbsp;SRVHARD003 [192.168.0.117]*<br />
&nbsp; 2 &nbsp; &nbsp;37 ms &nbsp; &nbsp;31 ms &nbsp; &nbsp;71 ms &nbsp;192.168.0.251<br />
&nbsp; 3 &nbsp; 205 ms &nbsp; &nbsp;39 ms &nbsp; &nbsp;31 ms &nbsp;router.ite.net [143.174.88.1]<br />
Trace complete.<br />
<br />
* reinstalled RRAS so internal interface is now 192.168.0.117<br />
<br />
Thanks QLEMO, appreciate the assistance.
</div>


<div>
Did I push you into the right direction, at least?<br />

</div>


<div>
QLEMO, spoke too soon.<br />
<br />
Everything works if the remote PC connecting to the server has a public IP, can access anything from within the LAN and outside the LAN (going out via LAN router). When I went home (after declaring everything works ..) I am stuck at verifying username and password. I believe it has something to do with the default route for subnet 192.xx., &nbsp;maybe it has something to do with my IP 192.168.1.148 from within my home lan?<br />
<br />
Sucks so bad, now i have to drive back to work to test again. <br />
<br />
<br />
<br />

</div>


<div>
Case opened. New problem with the solution.
</div>


<div>
I am pretty sure it is not GRE, as I am able to connect properly if I change the routing (I just couldn't connect to 143.xx subnet). <br />
<br />
Could you please advise more on NAT? Is it because I am assigning 192.168.0.xx addresses to RAS cliens and server is also on that subnet? I am familiar with NAT on routers but have not done it on Win2K.<br />
<br />
I guess the whole point is to setup the VPN such that all access go out via the LAN router, even for devices that are on the 143.xx subnet.
</div>


<div>
You were right all along. GRE was open on the firewall but blocked on the public interface of the RRAS. I missed it since I initially cleared the interface filters but had a couple re-deployments of the RRAS and I just forgot about it.
</div>


<div>
<div class="content wysiwyg-content">
I set up a Windows 2000 VPN server which has two interfaces: 143.174.88.30 (public) and 192.168.0.8 (private). I have other devices on the 143.174.88.xx subnet, 192.168.10.xx and 10.14.8.XX subnet (routed via 192.168.0.251, the LAN default gateway. I can connect to everything except devices that are in the 143.174.88.xx subnet. <br />
<br />
By the way, all the devices in 143.174.88.xx are conencted on the internet. LAN router also has a public interface that resides in the internet subnet, address is 143.174.88.210. We used to access via NAT in 143.174.88.210 but I thought we should do a VPN entrypoint using the VPN server.
</div>
</div>


I set up a Windows 2000 VPN server which has two interfaces: 143.174.88.30 (public) and 192.168.0.8 (private). I have other devices on the 143.174.88.xx subnet, 192.168.10.xx and 10.14.8.XX subnet (routed via 192.168.0.251, the LAN default gateway. I can connect to everything except devices that are in the 143.174.88.xx subnet. 

By the way, all the devices in 143.174.88.xx are conencted on the internet. LAN router also has a public interface that resides in the internet subnet, address is 143.174.88.210. We used to access via NAT in 143.174.88.210 but I thought we should do a VPN entrypoint using the VPN server.

Windows 2000 VPN routing

A virtual private network (VPN) is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or travelling users access to a central organizational network securely. VPNs encapsulate data transfers using secure cryptographic methods and other security mechanisms to ensure that only authorized users can access the network and that the data cannot be intercepted.

Windows 2000 is an operating system for use on both client and server computers. It is the successor to Windows NT 4.0, and is the last version of Microsoft Windows to display the "Windows NT" designation. Four editions of Windows 2000 were released (Professional, Server, Advanced Server, and Datacenter Server) that shared a core set of features, including many system utilities such as the Microsoft Management Console. All versions of the operating system support NTFS 3.0, Encrypting File System, as well as basic and dynamic disk storage. The Windows 2000 Server family includes support for Active Directory services, Distributed File System and fault-redundant storage volumes.