This topic

VPN not working from BT internet

startork — Tue, 02 Jan 2024 15:05:55 GMT

Our office VPN is not working when a member of staff is using BT broadband. The VPN works fine when using sky, virgin and mobile data but fails when using BT.

Tunnelblick returns the following Warnings:
Warning: DNS server Address 8.8.8.8 is a known public DNS server but is not being routed through the VPN

I have tried disabling the firewall and ensuring Port clamping is on.

Has anyone had a similar issue before?

Many thanks,

Re: VPN not working from BT internet

Keith_Beddoe — Tue, 02 Jan 2024 15:09:51 GMT

@startork

Welcome to this user forum for BT Retail phone and broadband customers.

Are you a BT Business customer?

Re: VPN not working from BT internet

startork — Tue, 02 Jan 2024 15:18:38 GMT

Hi @Keith_Beddoe

No, we are not. This is relevant for staff wfh with standard personal BT Broadband.

Re: VPN not working from BT internet

licquorice — Tue, 02 Jan 2024 15:24:30 GMT

@startork wrote:

Our office VPN is not working when a member of staff is using BT broadband. The VPN works fine when using sky, virgin and mobile data but fails when using BT.

Do you mean when that member of staff uses Sky Virgin or Mobile or other members of staff using those networks have no problem?

Is it just one member of staff that has a problem using BT or more than one?

You can see where I'm heading here.

Re: VPN not working from BT internet

startork — Tue, 02 Jan 2024 15:26:22 GMT

So far two members of staff with BT have tried to use the VPN and failed. Other members of staff who do not have BT have no problem.

Personally I have tested with sky, virgin, BT and mobile data and the issue only occurs on BT.

Re: VPN not working from BT internet

licquorice — Tue, 02 Jan 2024 15:27:26 GMT

If its a VPN into your office network, it seems strange to get an error message regarding Google DNS

Re: VPN not working from BT internet

startork — Tue, 02 Jan 2024 15:45:19 GMT

It seems this is the default DNS pushed by draytek, it does seem odd though.

Re: VPN not working from BT internet

licquorice — Tue, 02 Jan 2024 15:51:32 GMT

I assume the member of staff has the Draytek router.

DNS shouldn't be involved if the member of staff is creating a direct connection to your office network via a VPN.

Does the VPN sit on the Draytek or their laptop/PC?

Re: VPN not working from BT internet

startork — Tue, 02 Jan 2024 15:54:57 GMT

It is an OpenVPN connection which allows the draytek (office) router to push it's own DNS. It seems to be pushing this DNS and the device is connecting but traffic is then not being routed correctly via the VPN.

The member of staff has a BT Hub router I believe.

Re: VPN not working from BT internet

licquorice — Tue, 02 Jan 2024 15:59:40 GMT

Does the member of staff have FTTP or FTTC service?

If the former, they could try a direct PPPoE connection to the ONT to eliminate the home hub as the problem.

Re: VPN not working from BT internet

Anonymous — Tue, 02 Jan 2024 16:16:56 GMT

As the complaint is around DNS & the BT Hubs don't allow anything other than BT DNS, it might be worth setting the Google DNS on the device's NIC properties directly.

Re: VPN not working from BT internet

licquorice — Tue, 02 Jan 2024 16:21:17 GMT

Might work but surely the device is not using the hub's DNS at all but is tunnelling via the VPN to the office router and accessing DNS services there.

Re: VPN not working from BT internet

Crimliar — Tue, 02 Jan 2024 16:36:13 GMT

So by default BT routers use BT's pretty decent own DNS servers, and not Google DNS. It would look like your VPN server is pushing client DNS servers to users, but that this user's machine is then making DNS lookups back over the VPN link but to Google DNS. This is going to be a setting either in the VPN client or the network settings of the user's machine. It's not even that hard to over-ride using the routing features with a Draytek router (just route 8.8.8.8 and 8.8.4.4 to the DNS they should be using).
*Using an Asus router with multiple VPN and SDNS services available if they need to be called on
**If the client software is still using WinPCAP or similar, a more modern client could be a fix too!

Re: VPN not working from BT internet

countrypaul — Tue, 02 Jan 2024 17:02:41 GMT

When you create a vpn client connection, the vpn server normally sends the ip address, mask, dns address etc to the client to use for te connection. In this case it is suggesting that the client has been told to use the google dns server which it is trying to do. If the client is trying to use 8.8.8.8 then it may depend on whether the client is setup to allow split tunnelling or not. I know that by default Cisco client software did not allow that, the result being that any attempt to contact an ip address outside the clients local network would be routed to the vpn server. If the vpn server was also the gateway to the internet then by default the cisco router did not allow incoming packets to be routed (they had to remain on the local network the router was on. Using a Draytek with the default MS client would allow split tunnelling so ip addresses on the internet could be contacted directly. In both cases control was governed by the vpn server and what it sent to the client.

The error message suggests that the client is trying to contact 8.8.8.8 but not through the vpn. It might be worth trying a tracert to see what route is being (or not) taken to the google dns server.

Is this affecting all or only some BT Internet users?

Are the affected users Mac users? Are the unaffected users Mac users?

Re: VPN not working from BT internet

startork — Tue, 02 Jan 2024 23:14:04 GMT

Hi @countrypaul

This is only affecting BT Internet users and all users are on Mac. I will try tracert tomorrow and try and narrow down the issue.

Re: VPN not working from BT internet

countrypaul — Tue, 02 Jan 2024 23:22:38 GMT

You may want to read this if you have not already: Connects to the VPN, but doesn't work - Tunnelblick | Free open source OpenVPN VPN client server software GUI for Mac OS X.

Re: VPN not working from BT internet

startork — Wed, 03 Jan 2024 09:42:27 GMT

Yes I have, I don't believe it's actually a DNS issue, more a routing issue.
I cannot access resources with an IP address. If I try to ping an IP I get the error 'no route to host'.

Re: VPN not working from BT internet

countrypaul — Wed, 03 Jan 2024 10:31:18 GMT

Which IPs give an error those on the users local (home) network, those on the company network or those on the wider Internet (eg bbc.co.uk?)

Are you using IPv4 or IPv6 addresses?

What are the results of a Route print command (not sure what the Mac version is) both when connected to the vpn and not to the vpn?

Re: VPN not working from BT internet

startork — Wed, 03 Jan 2024 10:42:11 GMT

I am trying to ping an AWS hosted database so wider internet.

This is the results of a trace route when NOT connected to the VPN:
traceroute to www.google.co.uk (142.250.200.35), 64 hops max, 52 byte packets
1 192.168.1.254 (192.168.1.254) 3.249 ms 2.464 ms 2.769 ms
2 * * *
3 * * *
4 62.172.102.76 (62.172.102.76) 154.432 ms 6.135 ms
62.172.102.78 (62.172.102.78) 6.507 ms
5 peer2-et4-0-7.slough.ukcore.bt.net (62.172.102.33) 6.842 ms
62.6.204.207 (62.6.204.207) 7.979 ms
peer2-et0-0-7.slough.ukcore.bt.net (62.172.102.5) 7.275 ms
6 109.159.253.237 (109.159.253.237) 9.135 ms
195.99.126.247 (195.99.126.247) 9.533 ms
109.159.253.185 (109.159.253.185) 9.397 ms
7 * * *
8 108.170.234.220 (108.170.234.220) 12.882 ms
142.251.54.26 (142.251.54.26) 9.142 ms
142.251.54.48 (142.251.54.48) 8.765 ms
9 192.178.97.52 (192.178.97.52) 7.848 ms
142.251.52.143 (142.251.52.143) 7.520 ms
108.170.246.143 (108.170.246.143) 7.593 ms
10 lhr48s30-in-f3.1e100.net (142.250.200.35) 8.250 ms
142.250.215.205 (142.250.215.205) 7.856 ms
lhr48s30-in-f3.1e100.net (142.250.200.35) 7.679 ms

And this is when I am connected to the VPN:
traceroute: unknown host www.google.co.uk

And if I try to route to google's DNS then I get:

traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
traceroute: sendto: No route to host

Re: VPN not working from BT internet

countrypaul — Wed, 03 Jan 2024 10:55:12 GMT

I am hoping the Route print command (or Mac equivalent should shed some light on why.