Forgive my ignorance if this is something blindingly obvious. It is Monday!

I seem to have a strange issue with my VPN.

I have a 2955 - which is set to be the DHCP server. Start IP range is 10.1.100.2 with 245 pool counts.

Firmware is the latest on the UK site - 3.3.0

2955 is set to IP of 10.1.1.1, subnet 255.255.0.0

Whenever the first user connects to the VPN - it will generally allocate 10.1.100.2 - (depending on whether the first IP allocation has already been taken on the LAN)

When connected as the first user on the VPN - you can't connect to anything on the network. Computers don't even respond to a ping. I can ping the 2955 - but that's it.

The same computers respond to a ping if pinged when connected to the LAN.

If another user is already connected to the VPN - and I then dial in, I'm given another IP. When this happens, I can connect to and ping anything as if I am on the LAN (as I'd expect)- yet the first user who is already connected experiences the issue as above.

This is all on Windows 7. Have tried on multiple computers - and all behave in exactly the same way.

Here is a screenshot of my VPN user account - which is setup exactly the same as the other users.

LAN setup:

Just out of interest: have you asked Draytek? I found their support team to be very quick and very very helpful when I had a problem with a bunch of VPNs on 2900s.

BTW: Why such a huge subnet?

Well, I've tried the draytek forum, and emailed, but haven't yet had a reply, despite that being a few days ago.

Their tech support tel line is 77p/minute, and that will definitely be a last resort!

There are a lot of other devices on the LAN that have manual IPs assigned. Means we can seperate them and identify them much easier.

http://www.draytek.com/user/SupportFAQ.php?Id=3

Number 33? Any help?

Blimey, a scope for 65535 devices! One big network!

I run site to site VPNs on my Vigors (2 x 2820 and 2 x 2800) and also individual user logins too.

Are you accepting all those dial in types?

WIndows 7 firewall issue?

Yep.

As I said, it's very odd as it's only when the first user connects and they get assigned the first IP in the range.

If another user is connected, then it works fine.

Say user A connects first, then a minute later user B. User A has no connectivity, where as it works for user B.

Nothing changing in the setup, simply connect user B first, then user A - user A has connectivity, but user B doesn't

Draytek currently have my backup and are trying to replicate the issue.

Out of interest, if 100.2 is used by a computer on the wired LAN rather than the VPN (to me, it seems like you're bridging all your VPN users directly onto the main LAN?) then does that station function normally? Or does it exhibit the same symptoms as 100.2 via VPN?

Yep, if a user on the wired LAN has 100.2, it works absolutely fine.

Weird. Some kind of static route set up on the Draytek that would always put traffic for 100.2 out of the wired interface rather than over the VPN tunnel (i.e. I'm thinking that the ICMP echo request is actually making it from VPN client to server, but the ICMP echo reply is being redirected out of the wrong interface on the Draytek and ending up out on the wired LAN where no station is expecting it and just getting silently dropped)?

edit - this depends somewhat on the internal setup of Draytek routers, I've never used one myself, but I know it would be possible to do this on my Linksys router at home due to the architecture of it, so I'm guessing it could be done on yours either by accident or for historic reasons...

On my Draytek (Vigor 2830) I have the 1st IP for NAT usage on the same subnet as my IP pool i.e 1st IP for NAt is 192.168.40.1 and start IP for DHCP is 192.168.40.2

Not sure where you tell your Draytek to pass traffic between your 10.1.1.1 net and the 10.1.100.x net, maybe this is where the issue is?

Not sure where you tell your Draytek to pass traffic between your 10.1.1.1 net and the 10.1.100.x net, maybe this is where the issue is?

It's part of the same network, so there's no routing between the two required. Sam's using 10.1.0.0/16 so 10.1.0.1 to 10.1.255.254 are all valid IPs on the same network and the same broadcast domain. Seems excessive but I'm sure he knows what he's doing :p

ooops missed the mask