Flex 100H DNS over VPN Tunnel

PeterUK

Change VTI for 172.16.0.1 and 172.16.0.2 at both ends

P4Colin

Updated VTI to provided (our office 200H to 172.16.0.1/30 and client site 200 to 172.16.0.2/30). Verified I can ping from from computer to server and vice versa again after the VPN reconnected. Traffic from the router still does not traverse the VPN:

PeterUK

That problem must be the FLEX non H side have you got the right zone from to LAN?

PeterUK

OK I think I have found what you have done so you will need to remove the VTI and everything for the VTI and start over not sure if this is a bug or not on FLEX H

so when setting up the VTI DO NOT change the following for Policy and yes you MUST start over

P4Colin

https://community.zyxel.com/en/discussion/comment/74490#Comment_74490

THIS IS THE FIX! We did have this limited to just to two /24 subnets for each site. We did not need to recreate the VPN in this instance, we just updated the Phase 2 policies to the 0.0.0.0/0 subnets and now I am able to communicate from the router over the tunnel to the server.

This is a bit confusing compared to the non-H series, where in the Phase 2 settings it removes the local/remote policy options when you choose VTI. Not sure if this is just an oversight and needs to be taken out or if this is intended.

Thanks @PeterUK for your time and persistence!

P4Colin

When going back into the VPN setting again for further troubleshooting, I saw the options for Active Protocol and Encapsulation completely missing from the Phase 2 settings. I believe this may have occurred from attempting to add a second set of subnets in the Policy here:

The router started locking up to the point where it seemed like it would not send any traffic (computer behind the router lost its internet connection, pinging from Network Tool failed to any external sources). I was able to reboot it through the web interface and these options still did not reappear. I did have to delete the VPN completely and recreate it in order for these options to reappear.

Possibly a couple of bugs to look at here @Zyxel_Melen

*Edit - When the VPN gets into this weird mode, I am able to login to the device but it almost seems like something on the routing table is messed up since nothing is routed to the internet. Just by deleting the VPN, internet connectivity was restored.