VMware Workstation 16 Pro Guest can't connect over host VPN

[GregKukanich]

I have a host Windows 10 system, my guest VM is CentOS 7. I have a VPN to connect to a remote server. When on the host and connected to the VPN I can connect and access the server. If I open a copy of my guest CentOS 7 VM migrated to virtual box with the VPN connected I am able to access the server from within the guest, but when using my guest CentOS 7 VM in Workstation Pro I cannot access the server, my internet works fine I can access any other site but I am not able to access the server. When I attempt too I get a 'DNS_PROBE_FINISHED_NXDOMAIN' error. I am not sure what the difference is between my VirtualBox setup and Workstation Pro, but both are set to NAT and one works but not the other. I have tried searching for answers and cant seem to find one that works.

[CarltonR]

Slightly confused as you are initiating the VPN connection from within the guest to the remote server, but notwithstanding, assuming the guest CentOS 7 VM based on the VirtualBox is set to NAT, then I would suspect that Port Forwarding has been setup [Settings - Network - Port Forwarding button . . . or on the host].

Regarding VMware Workstation you can ether setup Port Forwarding or set the VM to Bridged networking.

[GregKukanich]

Sorry for the confusion the VPN is setup and running on the host. There are no no ports forwarded in VirtualBox all the settings for VirtualBox are default. The only thing I changed for it was running this command `VBoxManage modifyvm "RHEL 7" --natdnshostresolver1 on` when it was first setup. As for Bridged networking on VMware Workstation I have tried setting it to use Bridged Mode, it acts the same way as NAT, I am able to access normal websites but trying to access the server does not work.

[CarltonR]

Have you reviewed this post:

Cannot access VPN from guest
https://communities.vmware.com/t5/VMware-Workstation-Player/Cannot-access-VPN-from-guest/m-p/2820405

Post Note: Also check which network interface the guest VM is using.

[GregKukanich]

Just checked that post, I am a little confused when they mention using ipconfig to see the virtual gateways address, as to which they are referring to. But looking at my VMware settings for the VM in the NAT settings the gateway IP is 192.168.174.2 which I believe is correct as in the post you linked they mention changing that from .1 to .2 where mine is already set to that. 

[CarltonR]

In that case, just to confirm, may I suggest verifying the interfaces and associated IPs address in your setup.  Make sure that the host VPN is connected and working.

- on the host Win 10 run ipconfig/all and note all the network interfaces/IPs (VPN interface should be on the list)

- on the VMware CentOS Guest VM run ipconfig -a and again note the network interfaces/IPs

. . . and compare the two to ensure that the Guest VM is using the appropriate interface, and then if necessary do the same, as you say that it is working with the VirtualBox VM and compare.

As an aside would I be correct that VirtualBox and the VMware are on the same host.

Post Note: May I suggest, for clarity, that you upload the hosts and the guests network information, plus also the associated guests .vmx file.

[GregKukanich]

Yes both are running on the same host. After looking at everything the only difference between the VirtualBox guest and VMware Workstation network interfaces is the main IP address, my VMware guest has an IP that matches the 'Ethernet adapter VMware Network Adapter VMnet8' IP of my host, just with a .128 as the last number instead of the .1 the host adapter has. The VirtualBox guest however has a different IP and it does not match the 'Ethernet adapter VirtualBox Host-Only Network' on the host. Instead its starting with a 10 which matches the Ethernet Adapter for my VPN on the host that also has an IP address starting with a 10.

I am thinking this maybe where the problem is it appears the VirtualBox guest is receiving an IP from the VPN adapter and is able to access that network where as the VMware Workstation guest is not.

The VPN connects to a work network, when I am in person and on the actual network and don't need to use the VPN I have no issues accessing the server, its only when remotely connecting and using the VPN that I have this problem, which again I feel points to VMware not working the the VPN adapter on the host.

[CarltonR]

I'm slightly perplexed, so bear with me, you said in the original post that "my guest CentOS 7 VM in Workstation Pro . . . my internet works fine I can access any other site, but I am not able to access the [remote] server".  Would I be correct in assuming that this is the case for when the VPN is 'on' or 'off'.  It you are able to access the Internet from the VMware Guest then the NAT is working.  The VMnet8 is the correct virtual interface for NAT.

So, I have a number of questions for clarity, and to understand better the overall configuration:

1.   How many network interface/s are present on the host ?
2.  Which network interface is the VPN bound to, and is it setup for 'split-tunnelling' ?
4.  What are the Host IPs (if more then one) ?
5.  What is the Guests IP ?

[GregKukanich]

Sorry for any confusion and thank you for the help. So to clarify I am currently connected to a home network, to access a remote server for work I must be connected to the VPN. When working remote and the VPN is connected, I can access the server from the host and from the VirtualBox guest, but I am unable to reach the server from the VMware guest. When not working remote and in the office the VPN is not required, and the host, VirtualBox guest, and VMware guest all work as expected. 

Your questions:

1. Host adapters. Total of 9 appear when running ipconfig/all on the Windows 10 host
   1. Ethernet adapter Ethernet 3
   2. Ethernet adapter VirtualBox Host-Only Network
   3. Wireless LAN adapter Local Area Connection* 1
   4. Wireless LAN adapter Local Area Connection* 2
   5. Wireless LAN adapter Wi-Fi
   6. Ethernet adapter Ethernet 2
   7. Ethernet adapter VMware Network Adapter VMnet1
   8. Ethernet adapter VMware Network Adapter VMnet8
   9. Ethernet adapter Bluetooth Network Connection
2. I see the VPN on two of the adapters mentioned above. I am not sure if it is setup for split tunneling
   1. 'Ethernet adapter Ethernet 3' description is 'Fortinet SSL VPN Virtual Ethernet Adapter'. This appears to be the main adapter
   2. It also shows up on 'Ethernet adapter Ethernet 2' with a description of ' Fortinet Virtual Ethernet Adapter (NDIS 6.30)' but it says disabled.
3. Host current IP when connected to home network is 192.168.137.151
4. Guests
   1. VMware guest: 192.168.174.128
   2. VirtualBox guest: 10.0.2.15

[CarltonR]

Could you attach the exact output from the Hosts ipconfig/all (ipconfig/all > host.txt) to your next post.

[GregKukanich]

Attached

[CarltonR]

I don't appear to be able to locate the 'Fortinet SSL VPN Virtual Ethernet Adapter' on 'Ethernet 3' within the file, may I therefore ask you to rerun it when connected to the VPN.

[GregKukanich]

Apologies, fixed it.

[CarltonR]

Having reviewed this file/post there are a couple of anomalies compared with an implantation I have, but these may well well be red hearing.  I can see, unless I've missed something, which other forum contributors might point out, I cannot see, even with the multitude of network interfaces and the order of the DNS's, why the VMware implementation appears not to work, as per your VirtualBox.

Functional network Schematic

It would therefore be useful to confirm whether it is working and if the issue is something else.  Some of these may not work as expected as I am unfamiliar with some of the tech details, such as VPN split-tunnelling, or if your works outgoing Internet is accessible over the VPN.  So you might like to check and perform, the following (I'm sure you will get the gist of where I'm going with this, so amend as you see fit):

- Power down the VirtualBox
- Confirm within the VMware Workstations Guest VM .vmx file an entry, something along the line of ethernet0.connectionType = "nat" is present
- Power up VMware Workstation and the associated Guest VM

Then test the differences between when the VPN 'off' and then 'on'

Without VPN

[Host] Open a browser and navigate to your preferred search engine, and search for 'what's my IP'.

[Guest VM] Open a browser and navigate to your preferred search engine, and search for 'what's my IP', and confirm that this is the same as the Hosts.

[Guest VM] Open open a command prompt and run a traceroute to a local device on your network, and to an Internet web site using its DNS name.  Note the result and the path taken.

[Guest VM] Open open a command prompt and run a traceroute to a local device on your network, and to an Internet web site using its IP.  Note the result and the path taken.

With VPN

[Guest VM] repeat each of the above, and not the details, and note any changes in IP and route..

[Guest VM] Open open a command prompt and ping and traceroute your Remote Server by it both its IP and its DNS name..

VirtualBox

You might like to go through the above on the VirtualBox, for comparison, clearly the initial IPs will be different.

[GregKukanich]

So I went through all the tasks and the VPN being on or off didn't affect any of the results, regardless of the VPN being connected or not the amount of steps and IP addresses were the same. Searching "whats my IP" in Chrome on both the hosts and guests gave me the same result with VPN on and off. I tested using an amazon device on my local network and used www.google.com as the website/ip address to test. The only thing that was different across the tests was when running traceroute from Windows host or the VirtualBox guest it resolved the device on the local network as "amazon-d6... (192.168.137.33)" but on VMWare it only resolved it as "192.168.137.33 (192.168.137.33)" so it still reached it in the exact same steps but didn't resolve the name. Other thing was when testing with google.com and the IP, both Windows host and VirtualBox guest were able to show all the steps. On the VMware guest it took the same amount of steps but had asterisks for each step except for the last step where it displayed that steps results. 

I also tried traceroute to the remote server address and it worked on Windows Host and VirtualBox guest but on VMware guest I received an error "cannot handle host".

The only thing that stands out to me is Gateway address during the traceroute on Windows host its 10.something and VirtualBox guest it is also 10.something but on VMware guest it is 192.168.174.2.

[CarltonR]

That's interesting . . . one of the anomalies I mentioned in my post above was that VMnet8 was showing DHCP Enabled' set to 'Yes'.  I've looked at my setup and its set to No, however the difference between the two setups is that my host OS has static IP whereas yours is DHCP from the Wi-Fi router.  In addition, if you look at the Ethernet adapter on for the VirtualBox it is set to 'No'.  It may be nothing.  I've tried researching, but came up with nothing substantive.

I would suggest taking a look at the VMnet8 setting in the Virtual Network Editor (Edit - Virtual Network Editor).

Couple of things, your comment "Searching "what's my IP" in Chrome on both the hosts and guests gave me the same result with VPN on and off" which would imply that the VPN is configurated to use split-tunnelling (i.e. local traffic goes out of your router, were as remote server IP traffic is sent via the VPN).  Also, with the VPN 'on' and from the Guest VM did you also ping/traceroute the Remote Server using it's IP ?

Post Note: Regards the VirtualBox Guest having a 10.0.2.xx address,  This is will be different as it's picking the address from it own DHCP service.  The following is an except from VirtualBox Network Settings: All You Need to Know :

A virtual NAT device uses the physical network adapter of the VirtualBox host as an external network interface. The default address of the virtual DHCP server used in the NAT mode is 10.0.2.2 (this is also the IP address of the default gateway for a VM). The network mask is 255.255.255.0.

It appears NAT don't use an accessible virtual adapter as such, unlike the Host Only setup, so looks a though I will have to amend the schematic above.

[GregKukanich]

So I just tried traceroute with the Remote Servers IP in the VMware guest with the VPN on and it was able to run and return results. Which is interesting maybe its having issues with resolving the web address when I try and access it from the browser but idk why.

I also tried disabling the "Use local DHCP service" in the Virtual Network editor for NAT and restarting the VMware guest but it wouldn't connect to the internet at all, CentOS was giving errors about it not being able to connect to any network. Once I switched that setting back on the VMware guest connected.

[CarltonR]

Yes, it does sound like a DNS issue, which may help to narrow things down . . . at least the VPN is functioning. 

Q1: what is/are the DNS setting within the VMware Guest VM (ipconfig -a) ?

Q2: What happens, when you substitute the IP of the Remote Server into the browser, rather then it's name ?

[GregKukanich]

1. I've attached a picture of the results
2. If I use the IP address of the server in the browser on the VMware guest I get "connection refused error". However if I try using the IP address of the server in a browser on the Windows host I get "connection time out" error so on both it does not work. This is with the VPN on for both.

[CarltonR]

Unfortunately, it doesn't show the DNS/s (nameserver). . . could you run on the VMware guest cat /etc/resolv.conf