L2TP Over IPSEC VPN - Split Tunneling

Zyxel_Charlie

Hello Anthoshell,
On windows PC, we need to uncheck Use default gateway on remote network, and add routing on CMD. Please follow below steps.

You can implement the split tunnel configuration by following the steps below. 

1.    Go to Start > Control Panel > Network and Sharing > Change Adapter Settings.

2.    Right click the VPN Connection Adapter and click Properties from the pop-up to view the VPN Connection Properties Window.

3.    Switch to Networking Tab, select Internet Protocol Version 4 (TCP/IPv4) and click Properties to view the Properties window.


4.    In the Internet Protocol Version 4 (TCP/IPv4) properties window, click Advanced.


5.    In the Advanced TCP/IP Settings window under IP Settings tab, uncheck Use default gateway on remote network.

 
After that please add the routing on CMD on PC
Here is example, "route add 192.168.1.0 mask 255.255.255.0 192.168.100.33"
"route add (local policy) mask (subnet of local policy) (the IP address you get after VPN established)"
the"192.168.1.0" is local policy ,and "mask 255.255.255.0" is local policy subnet. "192.168.100.33" is the IP address you get after VPN established.

Charlie

Anthoshell

Thanks  It worked  ! 

ckelley

I am having the same issue; I have a server behind a USG 1000, I need to allow an outside user to RDP to the server, but he also needs to be able to access printers and other things that are behind a USG 50. To allow this, I created a site to site IPSec VPN between the USG 1000 and the USG 50. I then created a L2TP VPN on the USG 50, and have him logging in via Win 7's native L2TP.

He can log in successfully, and he can access all of the items behind the USG 50 as well as the server behind the USG 1000. However, while he's on this VPN, he can't access the internet at large, which means he can't check his email, which is essential to his work. Below is a diagram:



I have unchecked 'Use default gateway on remote network' on the Win 7 side, and he can then access the internet and his email, but he then loses connectivity to the server in Office B behind the USG 1000. I read this thread, and attempted to add the route to the Win 7 computer, but it didn't help anything.

I also tried to create the IKEv2 VPN for the user to log in using the certificate, but the server never responds when I attempt to connect this way, so the connection always fails.

I am at a major loss, and I'm hoping someone will take pity on my newbie self and offer some assistance.

Thank you in advance!

ChrisGer

ckelley said:

He can log in successfully, and he can access all of the items behind the USG 50 as well as the server behind the USG 1000. However, while he's on this VPN, he can't access the internet at large, which means he can't check his email, which is essential to his work. Below is a diagram:

Hello Ckelly,
is your VPN Network Segment a own segment ? or is this bridged ?
it this is a won IP Segement, remember, it's a virtuell Segment, that's not in the default routeing table of your USG. So you had to configure a routieng fpr your VPN Segment to the internet, f the user want to check mails in the extranet. It this allready configured on your USG ?


I have unchecked 'Use default gateway on remote network' on the Win 7 side, and he can then access the internet and his email, but he then loses connectivity to the server in Office B behind the USG 1000. I read this thread, and attempted to add the route to the Win 7 computer, but it didn't help anything.

Check the routeing from VPAN Segment to the Internet and configure this in the routeing section on your USG.

I am at a major loss, and I'm hoping someone will take pity on my newbie self and offer some assistance.

You are nit lost it's a bit more than attaching a vLAN to fullfil route the VPN 100 percent.

Thank you in advance!
Good luck
Christian