Host using guest VPN connection

[thj]

Hi,

Running Vista x64 on my host, I can't use the Cisco VPN client for etablishing a VPN connection to my work.

I read on the internet that some people got it working by etablishing a VPN connection in a guest OS (using VMWare), and then making the host access the IP of my work place through the guest OS.

The problem is, that I can't get this working, and I haven't been able to find a guide on how to do this.

What I've done:

Created a XP x32 guest with a bridged network and a host-only network. Host IP is 192.168.10.1 and guest IP is 192.168.10.2.

After installing Cisco VPN, I shared the Cisco VPN adapter connection by selecting "Allow other network users to connect th...."

This changed the IP of the guests host-only adapter, so I changed this back to 192.168.10.2.

After etablishing the VPN connection, and verifying that I'm able to ping 192.168.0.2 (ip at work), id ran the following command on the HOST:

route -p ADD 192.168.0.2 MASK 255.255.255.0 192.168.10.2

That is: route -p ADD <work-ip> MASK <netmask> <vpn_gateway>

Everything should be okay by now, but I can't ping 192.168.0.2 from the host OS.

What am I doing wrong? Could you please give me a hint in the right direction?

Thanks in advance.

Tommy.

[asatoran]

Can the guest PING the host after the VPN is established? Many VPNs can be configured to not allow "local LAN access." Cisco VPN endpoints can override the client settings. So if your guest cannot communicate with the host, you'll need to speak with your VPN administrator, assuming your company policy allows this relaxing of security.

[thj]

Thanks for your answer asatoran.

I'll check what you suggest when I get home from work (another job than the first mentioned one :-).

Then I'll return.

[thj]

I just checked it.

When VPN connection is established in guest OS I can ping work IP and host OS.

From host OS i can ping guest OS, but not work IP.

Any ideas?

[asatoran]

If host and guest can PING each other with VPN running, then VPN policy is allowing local LAN access. That's good. I'm not an expert on routing so I'll ask what may be a dumb question: You added a routing rule to the host, but do you also have to add a rule to the guest to get the response back to the host?

In any case, I have two other suggestions for you. Take a look at this thread.[http://communities.vmware.com/thread/120047] Forum member WoodyZ created a document on how to use the Internet Connection Sharing (ICS) of a Windows guest to provide internet for the host. It's written for Fusion for Mac, but the concept on the guest side is the same since it's just Windows configuration. I don't know if ICS works with a VPN connection.

But my second suggestion is even even simpler: why not just run the VPN software on your host? You may have to ask your VPN admin to allow your username to have multiple simultaneous sessions. And some home firewall routers don't allow multiple sessions. I've found the Linksys BESR41 & WRT54 only allow one VPN session, but all the dLink consumer firewalls allow multiple sessions. But running the VPN client on the host and guest would seem to be much simpler than trying to share the session out of the guest, (assuming ICS doesn't work.)

[thj]

I haven't added a routing rule to the host. Do I need that? Does it make any sence? If so, how should it look like?

I tried ICS like described in that guide. No luck.

My host is Vista x64 - thats the problem. No Cisco VPN client

[asatoran]

't added a routing rule to the host. Do I need that? Does it make any sence? If so, how should it look like?

Like I said, I'm not a routing expert, so I don't know if additional rules are needed on the guest or not. Also, the VPN policy may still be restricting such local LAN access, but if PING from guest to host works, then it does seem like you have LAN access from the guest.

I tried ICS like described in that guide. No luck.

It was just a thought, since I haven't heard of anyone being able to ICS a VPN.

My host is Vista x64 - thats the problem. No Cisco VPN client

Sorry, my bad. I missed that you were using 64bit. Per Cisco's website release notes for the VPN client software "For x64 support, customers should explore with their Cisco sales representative the use of the next-generation Cisco AnyConnect VPN Client." AnyConnect doesn't work with PIXs(?) so it looks like that might be Cisco's way of getting you to upgrade your VPN endpoint hardware.

[bwbecraft]

Hey Tommy,

I just encountered the EXACT same senario. I work in a developement studio, and we have a a lot of art guys that really need the 64 Bit OS to utilize all of their RAM. We use a cisco VPN as well.... Pain in the butt... Our VPN will not allow the use of ICS. It will terminate your connection and disable your VPN account for a few hours... so I worked around it. I created a shared file between the host and the guest. The user pulls any needed files from the vpn and places them in the shared file. Its an extra step, but it works. I had to share the file by mapping through the IP's. They wouldn't resolve Hostnames. That is another post all in itself though.

-BB

[thj]

Hi BB,

That would be a solution to some, but not me im afraid. I need the VPN to connect to some huge databases which I can't run locally. Because of the size and because they are updated regulary.

But thanks for your suggestion

Kind regards,

Tommy

[Texiwill]

Hello,

I used a VPN for quite a while within VMware Workstation.... If your VPN does not allow the use of ICS or something like that then the Host WILL NEVER be able to route through the VPN as it requires the VM to act as a router and most VPNs do not allow that to happen. If you are using Workstation then the best you can hope for is to use HGFS or if not then use a file server. But access through the VPN from the HOST will not work unless it is ALSO running the VPN or the VM acts as a router (which most VPNs do not like).

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009, DABCC Analyst
====
Now Available on Rough-Cuts: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing ESX and the Virtual Environment'
Also available 'VMWare ESX Server in the Enterprise'
SearchVMware Pro|Blue Gears|Top Virtualization Security Links|Virtualization Security Round Table Podcast