Mac OS X 10.6 issues connecting via vpn to Microsoft server

Question

I am currently running Mac OS X Snow Leopard and trying to use the native vpn client to connect to our Microsoft vpn server. If I route all traffic via the vpn connection I am able to connect to our servers, however, external traffic to i.e. google or stack overflow is blocked. If I uncheck the checkbox to route all traffic via the vpn I can connect to the vpn, however, I can not connect to my servers, external traffic to google or stackoverflow works though.

Is this a VPNclient issue, do I need to purchase Mac OS X VPN software instead of the native client, or is there a Microsoft vpn server setting that has to be checked. I am not familiar with the server software, but I wanted to post this question here to help out our network admin with the Mac OS X machines.

Update:

While I have not 100% ruled out the OS X VPN client, I have determined my router is definitely part of the issue. I have a Linksys wrt54g 1st gen, which worked perfectly for awhile, now I am guessing it has fried, because with it tied to my home network it prevents me from connected to my VPN. if i disconnect it and go directly through comcast, or any of my local coffee shops, everything works fine. once i replace the router to confirm, I was going to update this issue.

Solution 1

after switching to an apple wireless base station the problems subsided, as it turns out my router was bad.

Solution 2

My guess is that this is a routing issue. Try going to System Preferences -> Network, click the Gear/configuration icon under the interface list and select "Set Service Order..." from the pop-up menu. Once in the service order sheet, drag your VPN connection to the very top, save the settings, and try again. Leave the "Send all traffic over VPN connection" setting disabled.

If this resolves the issue, it's likely because the non-VPN network you are on is trying to route the packets to 65.x.x.x as it's an interface with higher priority in the routing table and also may have a valid route to 65.x.x.x, but obviously the connection doesn't complete due to routing/firewalling further down the line. The VPN interface is likely lower in the routing table than the non-VPN network, so by pushing it up in priority (and leaving "Send all traffic over VPN connection" off) it should route the VPN traffic correctly because it has a valid & more specific route to it, but will let the remaining traffic flow normally over the non-VPN interface.

Solution 3

Two things come to mind (I recently had similar VPN issues connecting to a PPTP server):

DNS (like GregD mentioned in the comments):

• Try connecting to or pinging a machine on the VPN network by IP address
• Open up the advanced properties for the VPN setup and add the VPN network DNS servers, and possibly the search domain(s).

Goofy routing setup (this is what was wrong in my case):

• Are the local and VPN networks in the same or overlapping private IP address ranges? If so you may need to use a different private address range for your personal network.
• Can you ping the default gateway on the VPN Network?
• If so can you ping or connect to any other machines on that network by IP address?
• If so are there other networks on the VPN side of the network that hold the machines you need to reach? If machines on the same network as the VPN gateway respond but you can't get to machines one or more hops past that you may be able to reach them by adding some static routes when you connect to the VPN.

Comments

[GregD]

Are you accessing your work servers via a DNS name?

[Chris Hough]

no, I am trying to access them via ip address start with 65. would the name be different?

[Chris Hough]

here is the current update, I can access both the servers over vpn with the "Send all traffic" over the vpn unchecked only through my tethered iphone. when I attempt to work behind my router or my favorite coffee shop, I can access both at the same time. any ideas?

[Chris Hough]

i can access the servers when connected and all network is routed through the vpn, but I will have to test to see the ping when I am connected but not routing all traffic. I will get the ips of our vpn network servers and try that tonight. I have tested this in multiple locations, my home, the local coffee shop, even tethered through my iphone all with no luck.

[Chris Hough]

here is the current update, I can access both the servers over vpn with the "Send all traffic" over the vpn unchecked only through my tethered iphone. when I attempt to work behind my router or my favorite coffee shop, I can access both at the same time. any ideas?

[morgant]

I'm not sure I understand that update. You can or cannot access both servers over the vpn when behind your router or at a coffee shop?