Windows – Initiating VPN connection kills RDP connection

networkingremote desktopvpnwindows 7

I am connecting via RDP to a Windows 7 Professional machine. I use that machine for its data/programs, but at times I also need to (within the RDP connection) connect to a VPN (configured via L2TP/IPSec), not on my client.

The problem is the VPN seems to take over all traffic, so I then lose my RDP connection.

What sort of network configuration (I'm thinking virtual adapters of some sort or the routing table) could I use to get around this?

Best Answer

I guess this might be fixed by simply disabling the option "Use default gateway on remote network" of the Windows VPN client. In XP that was hidden in the properties of your VPN network, tabsheet "Networking", "Internet Protocol (TCP/IP)", clicking "Properties", and finally clicking "Advanced".

That also means that most other traffic is no longer routed through the VPN. This includes browsing of websites, fetching email through POP or IMAP, and so on.

(However, it is enabled by default for a reason: it makes it a bit harder for malware to keep or reestablish connections once VPN is started, if the VPN administrator has blocked their network for such threats. Also, a company's policy might not allow you to disable it.)

Related Solutions

Windows – Make a VPN connection only for RDP

Can you uncheck "Use default gateway on remote network" in Properties for the VPN connection? It is hidden away in Networking, IPv4 Properties, Advanced, IP Settings.

Mikrotik Firewall rule: block all connection except to VPN server

PPTP uses

TCP port 1723
GRE (protocol ID 47) for tunneling

Accept PPTP in Mikrotik:

/ip firewall filter add chain=input action=accept protocol=tcp dst-port=1723
/ip firewall filter add chain=input action=accept protocol=gre

L2TP/IPSec uses

TCP port 1701
UDP port 500 for Security Association (SA) - to negotiate security method (password, certificate, kerberos)
AH (Protocol ID 50) - Authentication Header
ESP (Protocol ID 51) - Encapsulated Secure Payload

Accept L2TP/IPSec in Mikrotik:

/ip firewall filter add chain=input action=accept protocol=tcp dst-port=1701
/ip firewall filter add chain=input action=accept protocol=udp dst-port=500
/ip firewall filter add chain=input action=accept protocol=ipsec-ah
/ip firewall filter add chain=input action=accept protocol=ipsec-esp

Block all other incoming connection (TCP)

/ip firewall filter add chain=input protocol=tcp action=reject reject-with=tcp-reset

You can use action=drop instead of reject, but according to Hannes Schmidt, NMAP can still see the port is open but dropped (filtered) by firewall

Best Answer

Related Solutions

Windows – Make a VPN connection only for RDP

Mikrotik Firewall rule: block all connection except to VPN server

Related Question