Skip to main content
xcrezd
New Member
March 22, 2020
Question

Wrong Default Gateway after vpn is connected

  • March 22, 2020
  • 4 replies
  • 12748 views

Hi, After successful VPN connection, i cant send  ping messages to any endpoints on connected net. I see there is wrong Default Gateway automatically configured. Its always +1 of my new VPN ip. What am i doing wrong?

 

IPv4 Address. . . . . . . . . . . : 10.0.10.20 Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 10.0.10.21

    4 replies

    Toshi_Esumi
    SuperUser
    SuperUser
    March 22, 2020

    Right in the middle "Enable IPv4 Split Tunnel" is NOT checked. Means all traffic from the client side is supposed to come into the tunnel. That's why you got the new default gateway.

    infor
    New Member
    March 25, 2022

    Hello.
    I have the same problem.
    It does not assign me the correct gateway IP connected by forticlient

    It assigns me as the gateway the second ip in the range
    Range configured in forti 10.1.2.55-10.1.2.60
    Assign IP: 10.1.2.55
    and assigns IP gateway 10.1.2.56
    I should assign the 10.1.2.100 but I can't find where to enter that ip.

    Have you solved the problem

    Disabling or disabling IPv4 Split Tunnel causes the same problem.

    sw2090
    SuperUser
    SuperUser
    March 25, 2022

    As Toshi_Esumi wrote: If you enabled mode config but no split tunneling you will get an ip from your range assigned and it will rewrite your default route to send all traffic through the tunnel.

    If you don't want that to happen you have to enable split tunneling and then enter the subnet (or an address group of subnets) that should be reachable over the vpn on FGT side.

    With that set it will no longer touch your default route and will push routes to those subnets instead.

    Toshi_Esumi
    SuperUser
    SuperUser
    March 25, 2022

    And, I think the GW IP through the tunnel can be anything as long as it belongs to the other end, which is FortiGate, and not the one assigned to the client. It doesn't have to be +1. Can be +2, +3 or -1 within the range you assigned on the FGT.

    Toshi