VPN to remote network on same subnet as local network

Symptoms: 
You need to connect using VPN connection to remote client site and realize that you both using same IP subnet. You connect fine but can't access any resources on the remote subnet. Some people may suggest you to change one of the subnet, but you can't do that because both of subnet are office environment.


Cause:
It's network and route thing. Your PC think the remote IP is locally.


Solution:
You need to manually add routing for remote IP at your PC. You can do that using command ROUTE.
1. Connect to VPN site.


2. From command prompt run ROUTE PRINT to show status. In my case:

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 11 09 26 33 75 ...... VIA Rhine II Fast Ethernet Adapter - Packet Scheduler Miniport
0x60004 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.10.10.1      10.10.10.9  21
          0.0.0.0          0.0.0.0      10.10.10.79     10.10.10.79  1
        10.10.8.0    255.255.252.0       10.10.10.9      10.10.10.9  20
       10.10.10.9  255.255.255.255        127.0.0.1       127.0.0.1  20
      10.10.10.79  255.255.255.255        127.0.0.1       127.0.0.1  50
   10.255.255.255  255.255.255.255       10.10.10.9      10.10.10.9  20
   10.255.255.255  255.255.255.255      10.10.10.79     10.10.10.79  50
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1  1
  2xx.2xx.2xx.2xx  255.255.255.255       10.10.10.1      10.10.10.9  20
        224.0.0.0        240.0.0.0       10.10.10.9      10.10.10.9  20
        224.0.0.0        240.0.0.0      10.10.10.79     10.10.10.79  1
  255.255.255.255  255.255.255.255       10.10.10.9      10.10.10.9  1
  255.255.255.255  255.255.255.255      10.10.10.79     10.10.10.79  1
Default Gateway:       10.10.10.79
===========================================================================
Persistent Routes:
  None

3. From here, we get information:

   - 10.10.10.9      my current IP

   - 10.10.10.79     my assigned VPN IP

   - 0x60004               my VPN interface

   - 2xx.2xx.2xx.2xx  I need to hide my client public IP

4. To manually add route run:

ROUTE ADD <TargetIP> MASK <Mask> <GatewayIP> METRIC <Metric> IF <InterfaceID>

so for my case if I want to add route to single IP 10.10.10.18 on remote site:

ROUTE ADD 10.10.10.18 MASK 255.255.255.255 10.10.10.79 METRIC 1 IF 0x6004

5. Run ROUTE PRINT again to make sure the new route listed

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 11 09 26 33 75 ...... VIA Rhine II Fast Ethernet Adapter - Packet Scheduler Miniport

0x60004 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface

===========================================================================

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0       10.10.10.1      10.10.10.9  21

          0.0.0.0          0.0.0.0      10.10.10.79     10.10.10.79  1

        10.10.8.0    255.255.252.0       10.10.10.9      10.10.10.9  20

       10.10.10.9  255.255.255.255        127.0.0.1       127.0.0.1  20

      10.10.10.18  255.255.255.255      10.10.10.79     10.10.10.79  1

      10.10.10.79  255.255.255.255        127.0.0.1       127.0.0.1  50

   10.255.255.255  255.255.255.255       10.10.10.9      10.10.10.9  20

   10.255.255.255  255.255.255.255      10.10.10.79     10.10.10.79  50

        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1  1

  2xx.2xx.2xx.2xx  255.255.255.255       10.10.10.1      10.10.10.9  20

        224.0.0.0        240.0.0.0       10.10.10.9      10.10.10.9  20

        224.0.0.0        240.0.0.0      10.10.10.79     10.10.10.79  1

  255.255.255.255  255.255.255.255       10.10.10.9      10.10.10.9  1

  255.255.255.255  255.255.255.255      10.10.10.79     10.10.10.79  1

Default Gateway:       10.10.10.79

===========================================================================

Persistent Routes:

  None

Or You can use Portable GUI Application NetRouteView from nirsoft.net to show and manipulating your windows routing table.

Remotely Adding Firewall Exception List

Purposes:
You want to add Firewall Exception List under Client PC remotely

Solution:
1. Make sure you can remote registry Client PC
2. Open regedit.exe
3. File > Connect Remote Registry...
4. Browse your Client PC Name
5. Add this entry: (in this sample I add Radmin access)
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"4899:TCP"="4899:TCP:LocalSubNet:Enabled:Radmin"

6. To Enable Open File and Sharing Access
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:*:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:*:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:*:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:*:Enabled:@xpsp2res.dll,-22002"

7. To Enable Disable Firewall, using this Key
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall"=dword:00000001
"DisableNotifications"=dword:00000000
"DoNotAllowExceptions"=dword:00000000

Failure to Terminal Services ISA Server

Symptoms:
mstsc.exe (Terminal Services) failure to access ISA Server after some windows updates

Cause:

ISA server not allowing Remote Access from outside network

Solution:
1. From Administrative Tools > Terminal Services Configurator
2. Choose Connection
3. On Right Side, Right Click on RCP-Tcp then choose properties
4. Under Network Adapter Tab, make sure only your Internal Network is selected inside Network Adapter dropdown