Client VPN not able to access local LAN

[BeninChurchil]

Hi Experts,

I'm fairly new to Meraki products, So I configured Client VPN on MX67 Security Appliance VPN is working but not able to access local LAN, attached is the picture of both Client VPN & FIrewall page below, please point me what I'm doing wrong here ?

Local LAN Subnet: 192.168.1.0/24

Client VPN Subnet: 192.168.10.0/24

[KarstenI]

How did you test it, that you came to the conclusion that it doesn't work? Often enough it is the local firewall on the destination device that drops the traffic.

You can capture on the LAN side of the MX and look if you see the client originated traffic.

[JonathanSwitch]

I see that you have the DNS server setting set to use Google Public DNS. If you're attempting to reach internal resources via hostname, this will fail and you'll need to enter your internal DNS server.

Are you able to ping internal devices on the Local LAN via IP address?

[BeninChurchil]

I tried setting up domain as DNS in the Client VPN still not working ? I can't ping to my Domain also ?

More over I found out I don't have a Default gateway for the VPN ? Why ?

[JonathanSwitch]

Are you attempting or plan to configure split tunneling on your end client?

Can you verify if you have the "use default gateway on remote network" checked or unchecked? See this KB on how to find the setting on the adapter if needed: https://documentation.meraki.com/MX/Client_VPN/Configuring_Split_Tunnel_Client_VPN

If you're using MacOS, see the other option on that page, and let me know.

[BeninChurchil]

I'm running on Windows 11 Pro

It seems it is checked by default.

[BeninChurchil]

Should I create a static route ? from the VPN Subnet to local subnet ? 

[JonathanSwitch]

This is not needed. If you go to Network-Wide -> Packet Capture and take a packet capture on your MX's "LAN" interface, you'll notice that traffic from your client is traversing the VPN tunnel and being sent out on the LAN toward your DNS server, however, the DNS server is not responding. It is likely the firewall on the server that is dropping the traffic, but you'll need to investigate further as to why.

[PhilipDAth]

Can you ping the LAN IP of the MX?

You'll only be able to access internal servers via IP and not name using this configuration.

Also internal servers may need a Windows Firewall rule created to allow remote access from client VPN users.

Also, this configuration won't work if the subnet that the servers are on happens to be the same as the subnet that the users are connecting from at home.

[alemabrahao]

Have you enabled the VPN client subnet on SD-WAN?

Security & SD-WAN > Configure > Site-to-site VPN 

[alemabrahao]

 

[BeninChurchil]

Hi All,

You guys were right, It is the domain controller that is not being able to connect because other devices like switches, gateway, access points were able to ping & https accessable. But my domain controller which is Windows Server 2022 Standard. Its not pinging nor the SMB UNC path is also not accessible even RDP as well not sure if this is blocked by the server or firewall ?

[JonathanSwitch]

I am most certain it is the server's OS firewall. I believe most Windows Servers block remote subnets by default for public profiles. You'll want to check the rules for the Window's Firewall on the server and adjust accordingly.

[BeninChurchil]

Yes, I will dig in the Windows Firewall and then comeback and post once I find out..