We have another reader’s VPN question to answer this week. If you would like to ask us a network security-related question, drop us a line at firstname.lastname@example.org.
I guess I’m what you call a road warrior – traveling thousands of miles a year for business, regularly connecting to my company’s network offsite. When I’m working from home or at client site, I have no connection issues. Where I run into trouble is when I’m connecting from a hotel. Either I’ll find a connection and then lose it, or I’ll be connected, but my VPN access is denied. What’s even more frustrating is when there’s simply no connection at all. Any suggestions?
Confused road warrior
Dear Confused Road Warrior,
First things first, always check with your IT administrators on configuration of you laptop and tell the Help Desk what’s going on – they need to log the situation and troubleshoot for you. By way of background based on your explanation, it sounds like you’re the victim of overlapping subnets or a restrictive hotel firewall.
An overlapping subnet is when you establish a connection from the VPN client to another network with the same private IP address range. When this happens the IP addresses overlap with each other.
You tend to run into this when you’re on the road because the hotel router assigns your machine a private IP address range—say 192.168.1—and this address matches the office’s IP address. When your VPN client connects it’s using the source IP address it currently has—the home network or your office network—and the gateway you’re connecting to sees this as an internal (local) address. Thus subnets overlap and deny your VPN connection.
[If you’re curious about the technical description of overlapping subnets, we spoke to NCP’s engineering team, Lost Connections? Overlapping Subnets may be your culprit]
The other possibility is that the hotel’s firewall is too restrictive and it prevents your typical IPsec connection. Typically, your IPsec client won’t work in this situation because the encapsulated security payload (ESP) frames are dropped or modified by the router. However, there are some IPsec clients available that have features that allow for remote access behind firewalls and with settings to prevent IPsec-based data traffic. If this is a big problem for you, ask your IT manager to set you up with a different IPsec client that can navigate this for you automatically. The right tools are always better than finding workarounds for the wrong tool.
– The VPN Haus Editors
Send us your network security questions at email@example.com.