VPN Troubleshooting

Contents

Access Denied for internal UD resources

The VPN services allows you to connect to selected UD resources. The resource must be configured to allow the IP numbers assigned by the UD VPN server. If you get a access denied message, check your IP number and give it to the UD server administer responsible for the resource you are trying to access. (see VPN for UD Server Administrators.)

Checking your assigned IP number

First connect to UD VPN using your UdelNet ID and password, and then open your browser to www.udel.edu/ip. You should get a report similar to: 
Your ip address is 10.7.69.12
The time is 11/17/2009 10:38:40
Your reported hostname is 'host10-7-69-12.vpn.udel.edu'

This is your 10.7 private UD address. It is possible your UDelNet ID is assigned to a group that gets a subset of the total pool of allowed IP numbers. It is also possible that your IP number is statically defined so you always get the same IP number. The reason for these special assignments is to allow UD server administers the ability to allow you or a small group UDdelNet users access, while denying access to all others. To make this work the server administor needs to know the IP numbers which are reserved your you. (see VPN for UD Server Administrators.)

Ports for VPN service

VPN allows trusted access through untrusted wide area networks. That is, a user with UdelNet account and our UD VPN client can connect to UDelNet and be assigned a UD private address. All traffic is encrypted and thus safe from snooping on the untrusted network. However, it is important that all networks relay the packets from the VPN client to our VPN server. In particular UDP ports 4500 and port 10000 must be open in all firewalls.

With these ports blocked you may get a message such as 

contacting security gateway at 128.175.13.51 ...
with no connection made. If you are at an internet public site, there is not much you can do about their firewall configuration. Some hotels offer internet service upgrades to allow VPN. If you are visiting at another university you should bring this to the attention of their help desk.

Testing the ISP connection

On the machine with the VPN client open a browser with URL http://www.udel.edu/ip, and record the IP number and the time stamp. Normally the IP number should be a number assigned to your ISP, however when connected using the UD VPN client the ip number should begin with 10.7. If this is not the case, report the problem to the help desk with the incorrect IP number and time stamp.

Make sure the dns is working

Try the following pings: 
ping 128.175.13.51
ping vpn.nss.udel.edu
If the second one doesn't work, then you have a dns problem. Either fix the dns problem or reconfigure your VPN client and use 128.175.13.51 instead of vpn.nss.udel.edu.

Testing Split Tunneling

from www.vpntools.com:
Split Tunneling permits traffic destined outside the tunnel to proceed to your ISP's gateway while all traffic destined for addresses inside the tunnel to proceed through the tunnel. Without it you would only be able to access destination inside the tunnel.

After connecting to the UD VPN server, try to connect to a non-UD site. This should work, just as if you were not using VPN. Hosts inside of UDelNet should see you coming in with a 10.7 IP number, while all other hosts should see you using a globally unique IP number from your ISP.

note: Currently the UD VPN server considers IP numbers beginning with 128.4 as inside the tunnel, but the routers in the EE CIS network, which assigns the 128.4 IP numbers, will not route the private 10.7 addresses. This means split tunneling will not work going to hosts in the EE CIS network, and it means EE CIS servers can not be configured to allow UD VPN connections.

The proxy server does not work with VPN

128.175. The VPN is used to connect to internal UD hosts with a private IP number which begins with 10.7. These are conflicting tasks, and they will not work together. See VPN and Proxy servers for a detailed description for using both from home.

Return to UD VPN page
Go to UDeploy Software Site
 
Last updated November 17, 2009