VPN subnet mask?

I notice that by default the VPN subnet mask as configured by SBS 2008
does not respect the CIDR subnet mask on the LAN. This means that you
can't VPN from a 10.0.0.0/24 LAN via two NAT routers to a 10.10.10.0/24
LAN because the routing table gets two routes for 10.0.0.0 instead of a
route for 10.0.0.0 and a route for 10.10.10.0. Is this by design? Should
I change RRAS to use a static address pool (e.g. 10.0.0.2-8/24), or will
that cause other problems?

On 02/07/10 16:47, Neil Rashbrook wrote:
> I notice that by default the VPN subnet mask as configured by SBS 2008
> does not respect the CIDR subnet mask on the LAN. This means that you
> can't VPN from a 10.0.0.0/24 LAN via two NAT routers to a 10.10.10.0/24
> LAN because the routing table gets two routes for 10.0.0.0 instead of a
> route for 10.0.0.0 and a route for 10.10.10.0. Is this by design? Should
> I change RRAS to use a static address pool (e.g. 10.0.0.2-8/24), or will
> that cause other problems?

It may cause other problems. When the VPN shares the LAN DHCP pool, the
VPN is bridged to the LAN rather than routed. If it's different, with
SBS2003 you needed to explicitly arrange routing, and SBS2008 may be the
same.

I have a preference for avoiding the 10. network altogether, as I've
seen quite a few funnies where it has been used. In the Old Days, 10.
was by definition a Class A network, i.e. a /8 CIDR block, and some
firmware/software seemed to have this hardcoded in. When I kept the
subnet mask to /8, all was well. Using /8, of course, means there is
only the one 10. network, which makes routing problematic. The network
classes haven't been used for a long time, but you never know how much
software still contains fragments of old code.

Windows 7 still has edlin...

--
Joe

I have also noticed that connecting from my 10.100.100.x local network (subnetted to 255.255.255.0) to a SBS 2008 server on a 10.10.1.x network (subnetted the same) caused problems with local routing.

I went to this site and changed the RRAS configuration on the SBS 2008 server and now I no longer have those networking issues:

http://nicholas.piasecki.name/blog/2...n-in-sbs-2008/

> On Friday, July 02, 2010 11:47 AM Neil Rashbrook wrote:

> I notice that by default the VPN subnet mask as configured by SBS 2008
> does not respect the CIDR subnet mask on the LAN. This means that you
> cannot VPN from a 10.0.0.0/24 LAN via two NAT routers to a 10.10.10.0/24
> LAN because the routing table gets two routes for 10.0.0.0 instead of a
> route for 10.0.0.0 and a route for 10.10.10.0. Is this by design? Should
> I change RRAS to use a static address pool (e.g. 10.0.0.2-8/24), or will
> that cause other problems?


>> On Friday, July 02, 2010 2:47 PM Joe wrote:

>> On 02/07/10 16:47, Neil Rashbrook wrote:
>>
>> It may cause other problems. When the VPN shares the LAN DHCP pool, the
>> VPN is bridged to the LAN rather than routed. If it is different, with
>> SBS2003 you needed to explicitly arrange routing, and SBS2008 may be the
>> same.
>>
>> I have a preference for avoiding the 10. network altogether, as I have
>> seen quite a few funnies where it has been used. In the Old Days, 10.
>> was by definition a Class A network, i.e. a /8 CIDR block, and some
>> firmware/software seemed to have this hardcoded in. When I kept the
>> subnet mask to /8, all was well. Using /8, of course, means there is
>> only the one 10. network, which makes routing problematic. The network
>> classes have not been used for a long time, but you never know how much
>> software still contains fragments of old code.
>>
>> Windows 7 still has edlin...
>>
>> --
>> Joe