VPN connects successfully but internal servers are unreachable: should you check routing, DNS, or the firewall first?
Troubleshoot a connected-but-unusable VPN in order: address assignment, routes, internal DNS, access control, server firewall, NAT, and the return path.
Troubleshoot a connected-but-unusable VPN in order: address assignment, routes, internal DNS, access control, server firewall, NAT, and the return path. For this case, first verify VPN address-pool overlap with internal subnets and client routing table and pushed prefixes, then use internal DNS and name resolution to decide whether remediation is needed.
Define the failure boundary first
For this network and security-boundary case, establish the failure boundary with VPN and client routing table and pushed prefixes, then continue to internal DNS and name resolution. Capture the current state, incident time and one known-good comparison before changing production configuration.
Work through the dependency chain
| Check | Why it matters | Recommended action |
|---|---|---|
| 01 · VPN address-pool overlap with internal subnets | Verify VPN address-pool overlap with internal subnets on the affected path using logs, counters or state information rather than relying only on the configured rule. | Record the current value, evidence source and timestamp for VPN address-pool overlap with internal subnets. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 02 · client routing table and pushed prefixes | Verify client routing table and pushed prefixes on the affected path using logs, counters or state information rather than relying only on the configured rule. | Check client routing table and pushed prefixes read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 03 · internal DNS and name resolution | Verify internal DNS and name resolution on the affected path using logs, counters or state information rather than relying only on the configured rule. | Compare internal DNS and name resolution with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
| 04 · firewall/ACL hit logs | Review the current state, related logs and recent changes for firewall/ACL hit logs, then align them with the incident timeline before deciding whether a change is required. | Record the current value, evidence source and timestamp for firewall/ACL hit logs. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 05 · NAT exemption and session direction | Review the current state, related logs and recent changes for NAT exemption and session direction, then align them with the incident timeline before deciding whether a change is required. | Check NAT exemption and session direction read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 06 · server return routing | Review the current state, related logs and recent changes for server return routing, then align them with the incident timeline before deciding whether a change is required. | Compare server return routing with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
ipconfig /all
route print
nslookup server.corp.exampleChange only after the evidence is clear
- Start with read-only evidence. Check VPN address-pool overlap with internal subnets and client routing table and pushed prefixes before changing configuration.
- If the first checks are normal, continue with internal DNS and name resolution and firewall/ACL hit logs, keeping evidence tied to the incident time.
- Change configuration only when the evidence explains the symptom. For NAT exemption and session direction, preserve the original value and define the rollback trigger before adjustment.
- Validate server return routing in a controlled scope before expanding to production users or traffic.
Validation and rollback
- Validate the complete user or application workflow; do not stop at the single status of VPN address-pool overlap with internal subnets.
- Recheck NAT exemption and session direction and server return routing after the change and confirm that no new bypass, permission expansion or secondary error has appeared.
- Archive evidence from VPN address-pool overlap with internal subnets through server return routing, together with before/after configuration, business validation and the rollback point.
Common wrong turns
- Changing VPN and client routing table and pushed prefixes at the same time, which makes the original cause impossible to prove.
- Treating a normal result for internal DNS and name resolution as proof that firewall/ACL hit logs and the rest of the business path are healthy.
- Leaving a temporary exception related to NAT exemption and session direction or server return routing in production without an owner, expiry time and rollback note.
Related questions
Where should I start with “VPN connects successfully but internal servers are unreachable: should you check routing, DNS, or the firewall first?”?
Start with VPN address-pool overlap with internal subnets and client routing table and pushed prefixes; they establish the first useful troubleshooting boundary without changing production state.
What should be checked after the first layer looks normal?
Continue with internal DNS and name resolution and firewall/ACL hit logs, then correlate the result with the incident time and the actual user or application path.
What should be retained after the change?
Keep evidence for NAT exemption and session direction and server return routing, plus the original configuration, validation result, observation notes and rollback point.