Slow DNS Response using VPN

[RomeoS]

Hi,

I have recently set up a VPN server at home so I can securely access e-mail/banking etc whilst on the road. Specifications of the server are:

HP ProLiant ML350 G5
Intel Xeon E5420 2.5Ghz
4GB RAM
2 x 320GB Western Digital RE in RAID 1
Windows 2003 SP1 64bit

Backups done every night to another server which then is uploaded to a online storage site. The server is primarily used by me but there are accounts on there for 4 other individuals (VPN Only)

Internet Connection:

Be Pro 24/2.5Mbit Connection. Router Stats:

Uptime:	25 days, 22:20:17
Modulation:	G.992.5 Annex M US 56
Bandwidth (Up/Down) [kbps/kbps]:	2,330 / 23,735
Data Transferred (Sent/Received) [GB/GB]:	116.24 / 142.09
Output Power (Up/Down) [dBm]:	12.0 / 19.0
Line Attenuation (Up/Down) [dB]:	9.5 / 16.5
SN Margin (Up/Down) [dB]:	3.0 / 3.5
Vendor ID (Local/Remote):	TMMB / BDCM
Loss of Framing (Local/Remote):	0 / 0
Loss of Signal (Local/Remote):	0 / 0
Loss of Power (Local/Remote):	0 / 0
Loss of Link (Remote):	0
Error Seconds (Local/Remote):	1,456 / 0
FEC Errors (Up/Down):	0 / 0
CRC Errors (Up/Down):	0 / 2,159
HEC Errors (Up/Down):	0 / 201

Now I went through the "Manage Your Server" Add a New Role to install the VPN/Remote Access Server. I then created a DHCP server for the VPN clients seeing as I have DHCP disabled on my router for security. I also set the DHCP Server to automatically assign the routers IP address as the DNS Server to any VPN client.

When I connect from the laptop to the VPN server, it all goes through fine, I can register on the network and browse shares etc fine. The problem arises when browsing external websites.

Every few mins, the ability to resolve any web address seems to go kaput. It takes 2-3mins for Firefox/IE to "find" google.co.uk. I can see the laptop sending packets through the VPN connection but it appears the server does not respond. A few hits of the refresh button and it comes back and browsing is all well.

During the period where the server does not respond, I can still ping any machine in the network and the VPN connection stays working.

Any ideas on why the DNS is being a pain in the backside?

 

[Curiosityx]

It looks like you are routing all traffic through the vpn connection when browsing the internet remotely.

On the software VPN connection configured on your laptop find the vitrual vpn interface and uncheck "Use default gateway on remote network" under advanced TCP/IP Settings.

http://www.noc.ucf.edu/VPN/default_gw.htm
http://diaryproducts.net/about/operating_systems/windows/enable_disable_default_gateway_vpn_windows

Once this is unchecked any traffic not destined for your internal network at home will use the local gateway at the remote location.

Regards

 

[RomeoS]

Hi Curiosityx,

Many Thanks for your reply.

I unchecked the box as you suggested but then the laptop uses its wifi/3g connection to browse the web and no longer tunnels through the VPN (which it seems unchecking the box is supposed to do). I need all traffic to go through the VPN connection as normal. Just that the DNS seems to go kaput every few mins resulting in no web access.

 

[RomeoS]

Figured it out eventually.

Apparently, if you have two NIC's on the same Subnet and try to use VPN Server, it can make all sorts of weird things happen. Read that on a article last night, cant find the link now but it pretty much solved the problem.

Removed the 2nd NIC, manually set up VPN, Dial In, DHCP and DNS servers using 1 NIC and it works perfectly.

Just posting in case anyone else has the same problem.

 

[pjansell]

Hmmm strange one...I can't understand how that would cause an issue if the NICs are unique - if you manage to find that article, post up the link please.

 

[mynsa]

Figured it out eventually.

Apparently, if you have two NIC's on the same Subnet and try to use VPN Server, it can make all sorts of weird things happen. Read that on a article last night, cant find the link now but it pretty much solved the problem.

Removed the 2nd NIC, manually set up VPN, Dial In, DHCP and DNS servers using 1 NIC and it works perfectly.

Just posting in case anyone else has the same problem.

why not bridge the nics, giving the bridge a single ip address and then allocating each interface to the bridge?

by having two ips from the same subnet configured on your two nics im guessing your only confusing the routing table and any arp tables on your switches / routers

 

[RomeoS]

why not bridge the nics, giving the bridge a single ip address and then allocating each interface to the bridge?

by having two ips from the same subnet configured on your two nics im guessing your only confusing the routing table and any arp tables on your switches / routers

Tried that but Windows 2003 wouldn't let me select the bridged connection during VPN set-up.

Never did find that article again, forgot the exact terms I was googling, but the server has been working without fault.