This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN connects, but doesn't route traffic or do much at all

I recently upgraded to ASG 7.500.  Prior to the upgrade, my SSL VPN worked fine; however, after the upgrade, it is no longer working properly.  I downloaded and installed the latest client from the user portal (for Windows 7 RTM x64), and ran it as Administrator.   It connects to my ASG and gives me an IP address from the VPN Pool (SSL), but it doesn't tunnel my network traffic through the VPN connection (for example, my external IP address does not change, like it used to when it was working properly).  The Astaro client shows that it connects properly and everything looks like it's working, but nothing actually happens with the network traffic.

I checked the network addresses and subnet masks of all other VPN Pools (Cisco, IPSec, L2TP, and PPTP) and they are all properly subnetted into non-conflicting and separate networks. (With a /24 subnet mask)

Under Network Security --> NAT, Masquerading, there is a rule to allow VPN Pool (SSL) -> External (WAN).  I have not changed any configuration settings--I have only upgraded to 7.500.

When I view the live SSL VPN log, it shows everything connecting properly and doesn't show any errors.  The last line shows "Peer Connection Initiated with x.x.x.x"

Could it be that my campus is blocking SSL VPN connections somehow?  If I understand correctly, they would have to block port 443 (which my ASG is configured to use for SSL VPN connections), which would also disallow secure connections to web sites, etc.

The problem exhibits itself on both Windows (with the Astaro/OpenVPN client) and Mac OS X using (using Tunnelblick).  I had the VPN working properly with Windows 7 RTM x64 before the upgrade to ASG 7.500.

Any suggestions would be greatly appreciated.

This thread was automatically locked due to age.

Parents

0 ClarkDaughtrey over 15 years ago

Try this:

SSL client connects but no traffic routes

After connecting with the ssl client the connection status shows green. However traffic flow doesn't appear to occur. This is due to the route commands not having administrative priveleges on windows systems when run as a limited user account.

In the Astaro SSL client log the following error regarding routes will be shown:
Route addition fallback to route.exe

Setting administrator rights to a program:

STEP ONE

=======================

In Wordpad, open the following file: c:\Program Files\Astaro\Astaro SSL VPN Client\config\(user credentials)

Then, go to the bottom of the file and add the following lines:

route-method exe

route-delay 2

STEP TWO

=======================

Next up is to change the Astaro VPN client to always run as an administrator. Go to this location with Windows Explorer:

c:\Program Files\Astaro\Astaro SSL VPN Client\bin\

Highlight the file openvpn-gui.exe and then right-click. Choose properties. Click the "Compatibility" tab and check the checkbox "Run this program as an administrator" and click ok.

STEP THREE

======================

We now need to remove the Astaro VPN Client from startup, otherwise it will be blocked because of "Administrative Behavior".

- Click START ---> RUN and type msconfig and then click OPEN

- Click the STARTUP Tab and uncheck openvpn-gui

- When you restart your PC again, it will ask if you want to run msconfig again, just check the appropriate checkboxes so it will not do that in the future.

STEP FOUR

=======================

Click START ---> ALL PROGRAMS ---> ASTARO SSL VPN ---> ASTARO VPN Client

Right click the traffic light and choose connect.

After authenticating, you should be able to access network resources
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ClarkDaughtrey over 15 years ago

Try this:

SSL client connects but no traffic routes

After connecting with the ssl client the connection status shows green. However traffic flow doesn't appear to occur. This is due to the route commands not having administrative priveleges on windows systems when run as a limited user account.

In the Astaro SSL client log the following error regarding routes will be shown:
Route addition fallback to route.exe

Setting administrator rights to a program:

STEP ONE

=======================

In Wordpad, open the following file: c:\Program Files\Astaro\Astaro SSL VPN Client\config\(user credentials)

Then, go to the bottom of the file and add the following lines:

route-method exe

route-delay 2

STEP TWO

=======================

Next up is to change the Astaro VPN client to always run as an administrator. Go to this location with Windows Explorer:

c:\Program Files\Astaro\Astaro SSL VPN Client\bin\

Highlight the file openvpn-gui.exe and then right-click. Choose properties. Click the "Compatibility" tab and check the checkbox "Run this program as an administrator" and click ok.

STEP THREE

======================

We now need to remove the Astaro VPN Client from startup, otherwise it will be blocked because of "Administrative Behavior".

- Click START ---> RUN and type msconfig and then click OPEN

- Click the STARTUP Tab and uncheck openvpn-gui

- When you restart your PC again, it will ask if you want to run msconfig again, just check the appropriate checkboxes so it will not do that in the future.

STEP FOUR

=======================

Click START ---> ALL PROGRAMS ---> ASTARO SSL VPN ---> ASTARO VPN Client

Right click the traffic light and choose connect.

After authenticating, you should be able to access network resources
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 t-work over 15 years ago in reply to ClarkDaughtrey

Hi ClarkDaughtrey,

thanks for that post - a really good How-To.
But at least on my side the error occurs no matter if ppl have Administrator rights or not. Also, even people without Administrator rights but with a group membership in "Network Operators" have always been able to connect properly due to the rights to change routes.

Reinstallation of an old client has helped all of my users until now.
So I believe that there must be something wrong with the new client: it does not even try to set routes to *any* internal network - nor does it try to add 0.0.0.0 route when I set "any" as local network.

Let's hope Astaro will fix it soon - and that something like that doesn't happen too often.

Best regards,
t-home
Cancel
Vote Up 0 Vote Down

Cancel

SSL VPN connects, but doesn't route traffic or do much at all

Submitted a Tech Support Case lately from the Support Portal?