Day 3.3: Setting up routing

Introduction

Yesterday I built a network of virtual routers in GNS3 and connected my VMs to them. Today I'm going to work on configuring them to actually route traffic around the virtual network.

Getting started

As a reminder, here's what the network looks like right now:

To start out, I figured I should configure Core0 to connect to the Internet. Essentially, I started with the instructions here to set my "external" interface on Core0 (Fa0/0) for DHCP:

Core0#

*Mar  1 00:13:24.639: %DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0/0 assigned DHCP address 172.20.179.154, mask 255.255.0.0, hostname Core0

Core0#

So far so good - Fa0/0 now has an IP address on my home LAN. Equally importantly, it now has a default gateway assigned for routing traffic out to the Internet.

Core0#ping 75.75.75.75

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 75.75.75.75, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

Okay, my bad. The default route forwards out to Fa0/0, but there's no default gateway set.

Core0(config)#ip route 0.0.0.0 0.0.0.0 172.20.0.1 permanent

Core0(config)#^Z

Core0#

*Mar  1 00:24:31.687: %SYS-5-CONFIG_I: Configured from console by console

Core0#sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.20.0.1 to network 0.0.0.0

C    172.20.0.0/16 is directly connected, FastEthernet0/0

     172.25.0.0/24 is subnetted, 2 subnets

C       172.25.1.0 is directly connected, FastEthernet1/0

C       172.25.2.0 is directly connected, FastEthernet2/0

S*   0.0.0.0/0 [1/0] via 172.20.0.1

               is directly connected, FastEthernet0/0

Core0#ping 75.75.75.75

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 75.75.75.75, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 60/78/96 ms

Core0#

Much better.

Next step is configuring the rest of the routers to learn routes. At this point, for simplicity, I'm going to use RIP.

Fortunately, GNS3 lets me edit each router's startup-config in a text editor so I don't have to manually enter all the config commands on each router to add:

router rip
version 2
network 172.25.0.0
network 172.26.0.0
network 172.27.0.0
network 172.28.0.0
network 172.29.0.0
no auto-summary

Next up, configure Core0 to propagate its static route via RIP:

Core0(config-router)#default-information originate

A quick check of Core2 confirms that the default route has propagated:

Core2#sh ip rip database

0.0.0.0/0    auto-summary

0.0.0.0/0

    [1] via 172.25.2.1, 00:00:01, FastEthernet0/0

Unfortunately, I can't ping 75.75.75.75 from Core2.

Tracerouting shows that packets are making it to Core1 and no further.

Core2#traceroute 75.75.75.75

Type escape sequence to abort.

Tracing the route to 75.75.75.75

  1 172.25.2.1 64 msec 64 msec 60 msec

  2  *

Oops. Apparently GNS3 Clouds don't work the way I had thought - I need to enable NAT so that Core0 can translate packets between my virtual LAN and my home LAN.

After some quick changes (irrelevant lines omitted):

interface FastEthernet0/0

 ip nat outside

interface FastEthernet1/0

 ip nat inside

interface FastEthernet2/0

 ip nat inside

ip nat inside source list 1 interface FastEthernet0/0 overload

!

access-list 1 permit 172.25.0.0 0.0.255.255

access-list 1 permit 172.26.0.0 0.0.255.255

access-list 1 permit 172.27.0.0 0.0.255.255

access-list 1 permit 172.28.0.0 0.0.255.255

access-list 1 permit 172.29.0.0 0.0.255.255

I can now ping the outside world from Core2.

Next up: configure default route propagation between all core routers with default-information originate.

Even after doing this, route information is not making it to Access1.

After some digging, I discovered that neither Core1 or Core2 was sending RIP updates to Access1 because I'd somehow forgotten to activate that interface on both Core1 and Core2.

After fixing this, I tried to ping 75.75.75.75 from Access1 - it worked, but only with a 40-60% success rate. Same with most other Internet sites I tried.

Problematically, this doesn't appear to happen if I try it from my physical machine, and I don't have this problem with pings anywhere in my home LAN. It looks like the latency within GNS3 - while not a problem as long as I'm inside my own network - is too slow for traffic to the Internet.

This isn't really a problem, except that my Windows 2016 server needs to be able to access the Windows Update service, and it can't do that if packets are constantly timing out.

Fortunately, this should be a fairly easy fix - I can add a second network adapter to that VM in VMware, connect it directly to my home LAN (bypassing GNS3) and set that as the default route for all traffic not headed for my virtual LAN.

So at this point, my W2016 VM has two network connections: SIMULCRON (connected to my virtual LAN) and EXTERNAL (connected directly to my home LAN.)

(It was also at this point that I switched ExtEdge2 back to a two-port router, and added a generic switch connecting the Windows 2016 VM to it, for simplicity configuring the router.)

Here's what my routing table ended up looking like:

Oddly, at this point, I can access the Internet and ping ExtEdge2, but I can't reach the rest of the virtual LAN.

(Sidenote: I discovered during this process that GNS3 doesn't handle editing of startup-config via the text editor very well if you do it while the VND is running.)

Not too soon after, I realized I'd never configured ExtEdge2 to advertise its path to Win2016 (which is on the 10.1.0.0/16 network, rather than the rest of the virtual network, which is a 172.* network.) After adding 10.1.0.0 to the RIP database on ExtEdge2, everything worked perfectly - and I confirmed I can ping from Core0 to Win2016, and back!

Next up...

Next step will be setting up user VLANs, like I planned in the original network diagram.

As an aside, while network performance is fine, Win2016 is struggling to paint the screen when I'm doing command-line stuff. I may also start using VPCS simulators to test network connectivity.

Day 3.2 - Designing/building a LAN

Introduction

In the last couple posts I went through setting up GNS3 to act a network simulator to route traffic between my virtual machines.

(As an aside, I had to update my Windows 2016 VM last night and it took... a really long time. At some point, the number of VMs I'm running may become an issue - especially with the number of routers I'm putting into the GNS3 VM. But I'll cross that bridge if I get there.)

LAN Design

I'm not a professional, so I didn't make this TOO terribly fancy. (Although it ended up being fancier than I originally anticipated.)

I had a few objectives:

• Multiple VLANs to practice trunking/switching/etc.
• A DMZ outside the main network
• A "core" network with multiple routes, to practice with routing protocols

With that in mind, here's what I came up with.

I made it in a program called CADE, which is a little finicky. I didn't want to start putting things into GNS3 - which makes them "real" - until I had a layout in mind.

As far as end-user devices go, GNS3 has a feature called VPCS - or, Virtual PC Simulator. This allows you to create miniature console-based VMs that do the bare minimum to respond to network traffic - so you can test connectivity from an end-user perspective, without going to the trouble of building a full-fledged OS-based VM.

With that in mind, for my virtual network, I decided I'm probably going to only run a single actual VM for testing Windows domain-based stuff, and use VPCS for the rest.

Starting the build

First thing to do: start GNS3 (which helpfully starts up its own VM.)

Next up: drag all my devices into place, and connect them.

Almost immediately I hit a snag: it turns out you can only have one device connected to a cloud interface. So I ended adding another router to the mix. At the end, it looked like this:

Next step was an IP addressing scheme. It's really complicated and not that exciting, so I'm going to skip it. Now for the fun part: going in and manually configuring all those routers.

Immediately, another problem emerges: the 2691 is a layer 2 switch. All the switching ports I used to set up the mesh can't be assigned IP addresses.

After some digging, I found that I should be using a Cisco 3745 router instead. Rather than using the 16-port switching plug-in, I just added a single extra virtual Ethernet port/card for each connection.

(Several hours later...)

Finally got it done.

With 7 out of 8 virtual routers running, as well as the Win2016 VM, my physical machine's barely using any CPU. (RAM is another story, but to be fair, I also have about 20 other programs open.)

Next step's going to be configuring all the routers to talk to each other... but that's for another day.

Day 3.1 - Customizing GNS3

Introduction

In the last entry, after some VMware headaches, I got GNS3 up and running. Next step: add the customization I need to build my virtual LAN.

VND Templates

If you recall, I said I was going to refer to virtual network devices running in GNS3 as VNDs to avoid confusing them with virtual traditional machines running in VMWare.

When it comes to VNDs, GNS3 operates from "templates," which are a collection of hardware settings and the specification of what IOS ROM image to use for the VND. VNDs are instantiated using this template, and then configured like a standard hardware device.

When I left off, GNS3 had just asked me what kind of template I wanted to create first:

I'm going to start by creating a basic IOS router template, which will work for now.

First question is whether I want to run the VND inside the GNS3 VM, or on my local computer. I went with the GNS3 VM.

Next I was prompted for an IOS image. I selected the image file I had on hand (Very basic Cisco 2691, with Enterprise Base feature set.)

At this point, suddenly, GNS3 found itself unable to talk to the VM again.

I noticed that it was trying to connect to an IP address on my home LAN... which the GNS3 server does not have, since it's operating inside a host-only network.

I went into Preferences and specified for the GNS3 server to bind to my VMware virtual NIC assigned to the host-only network. When I did this, the GNS3 VM rebooted. After it came back up, I noticed the VM was now showing green in GNS3, which it wasn't before. Good sign.

I went back to add the IOS image and this time it worked perfectly.

Next I was prompted to name my template and specify the platform (2691.)

Next, I was prompted for the default RAM. I checked Cisco's website and found the minimum RAM for this image was 128MB so I went with that.

Next was selecting what network adapters should be attached by default to new instantiations of this template. I only planned to use 1 slot, so I used the default.

Next was selecting a default WAN interface card for new instantiations. I don't need one, so I left it alone.

Next I was prompted for an "idle-pc" value, which is apparently necessary to keep IOS from using up 100% of a CPU core. Helpfully, there was a button to find it, which took about 30 seconds.

I now had a ready-to-use Cisco 2691 template, ready to go.

Adding in VMWare VMs

For some reason, GNS3 also refers to VMWare VMs as "templates." I'm not really sure why this is, because there's only ever one instance of a particular VM. Regardless.

Anyways. Essentially, I followed the steps in this document to add my existing Windows 2016 Server VM as a template.

One problem I have with GNS3's documentation is that it's written almost entirely in the form of tutorials, and is pretty light on the explanations of why you're doing what you're doing.

Mainly, when I get to the part telling me what to do on the Network settings tab:

Well, a few things. For one, my screenshot doesn't match theirs - I only have one checkbox, they have two. Second, I don't know what any of those boxes mean (aside from Type) and whether they might be important.

Regardless...

On the "VMware Preferences/Advanced local settings" tab, the document says to have GNS3 manage VMnets 2-8. I'm just going to have it manage VMnet 2, since that's the one I assigned for my lab experiments.

After clicking "Configure" on that screen, GNS3 runs some commands to assert control of VMnet2.

Testing it out

At this point, I don't want to go through the trouble of configuring a Cisco router just yet - I just want to make sure I configured everything correctly.

First things first: create a new project in GNS3, and obtain a blank canvas:

Note that over on the left, I have the "End Devices" section open and you can see my VM (and a few other things that will be useful later) available for placement. If I opened up the "Routers" section, you would see my 2691 router template available for placement.

I'm gonna do a couple things: drag my VM over and drop it on the canvas to add it to my network, and drag a "Cloud" object over to the canvas as well.

When I do the second one, I get this question:

Before I answer this, let me try and explain what I think a Cloud object is. (I'm not 100% sure because of the way GNS3's documentation is written.)

As best I can tell, a Cloud can do a handful of things. The main one - at least, the main one I'm concerned with for now - is the ability to make a network interface on a machine (physical or virtual) act as a "proxy" for an interface attached to a VND/VM.

It'll probably make more sense if I demonstrate. But long story short, I choose Amateria (my local physical machine) because I want traffic to flow through my home LAN, which my GNS3 VM is not directly connected to.

After that, I have to configure the Cloud before I can use it.

Essentially, at this point, I've configured Cloud 1 so that it can "proxy" traffic out through my physical machine's Local Area Connection, onto my home LAN.

Next step is to create a link between my Windows VM and Cloud-1, using the "Add a link" button on the left. When I click the Windows VM, I'm prompted to select an interface on the VM, and the same when I click the Cloud. (Each only has one option right now, but I could add more.)

Once it's done, it looks like this.

On the right, you can see a list of connected GNS servers, and what's running on them. At this point, I don't have anything running on the GNS VM, because both the Windows Server VM and Cloud-1 are hosted on my physical machine. Note that anywhere Windows Server appears, it's with a red square at this point, because the VM is turned off.

Now. What I've done by connecting the network interface on Windows Server, to my physical interface through the Cloud, is created a "link" where Windows uses its virtual network interface, and GNS3 transparently takes that traffic and routes it out through the physical interface. When traffic comes back, it works in reverse - GNS3 takes it from the physical interface, and passes it to the VM, and as far as the VM's concerned that traffic came straight from its virtual interface.

All right. The green "Play" button up top will start up all the virtual nodes on the network...

After hitting Play, GNS3 starts up the Windows 2016 Server VM for me.

Moment of truth...

Well. I wasn't expecting it to come back in IPv6, but if I ping an IPv4 address, I get a response back. My VM's connected to the Internet through GNS3!

Next step

Next step's going to be adding a virtual Cisco router into the mix and confirming that GNS3 is fully working.

But for now, Heroes of the Storm calls...

Day 3 - Integrating GNS3 and the VMWare environment

Introduction

It's been a couple weeks, I've been busy getting ready to separate from the Air Force. But I'm on terminal leave now, and I've got nothing but free time!

What's Next

I've never been great at focusing on one thing at a time. Especially in the last couple months, when I've been at work and not able to access my VM environment, so I was just reading e-books on certifications. Unfortunately, with no access to a test environment, I can only read so much about a single topic with no hands-on practice before I have to switch tracks and read about something else.

With that in mind, I ended up switching tracks for a little bit to read my CCNA study material.

As with other certification projects, CCNA is hard to train for without a lab environment. GNS3 - the network simulator I mentioned earlier on - can provide that environment. But, I didn't want to branch off into a completely separate project. So I found myself wondering... can I integrate my current virtual environment with GNS3?

As it turns out... I can.

Getting Started

GNS3 basics

As a reminder, GNS3 is a simulator capable of running Cisco IOS images as virtual machines - except in this case, the "VMs" are network devices rather than traditional computers. (I'm going to call them VNDs just to avoid confusion.

I already installed GNS3 using pretty much all the default options (minus the numerous pleas to install Solarwinds stuff.)

When you first start GNS3, you have to configure it.

GNS3 offers a few different ways you can run VNDs:

1. The first option entails running a custom GNS3 Linux VM on your local machine, and your VNDs will run inside of that.
2. The second option is to have no GNS3 VM, and run your VNDs directly on your host operating system. According to my research, Windows has problems with emulating certain VNDs, which is why option 2 limits the types of VNDs you can run.
3. The last option is to connect to a remote GNS3 server, which hosts all your VNDs.

I'm already virtualizing everything, and I like functionality, so I went with option 1.

On the next screen, I went with the default options for the GNS3 server.

Next, assuming you went with option 1, GNS3 asks how you want to run the GNS3 VM.

You have two virtualization software options: VMWare, and VirtualBox.

As far as free stuff goes, you have a couple options: VirtualBox is free, as is the slimmed-down version of VMWare called VMWare Player. As you might expect, though, free comes with a couple drawbacks - VirtualBox doesn't support nested virtualization, which means it may run VNDs slowly. VMWare, being a free edition, doesn't let you do some really helpful things (like run multiple VMs at once.) If you're not planning on running any other VMs, though, VMWare Player should work fine for running the GNS3 VM by itself.

Anyways. I have VMWare Workstation, so I went with that one.

The neat thing about VMWare is that it has an interface for external software - like GNS3 - to integrate with it. So once you download the pre-built GNS3 VM from GNS3's website, all you have to do is double-click it, and it'll automatically import itself into VMWare, and GNS3 will be able to see it and interact with it.

I already did this, which is why "GNS3 VM" is already selected. I left the vCPU and RAM size alone, and finished configuration.

Starting GNS3

After you finish setup, GNS3 with automatically start its VM within VMWare.

At this point, I hit a snag, in the form of this dialog box, which kept going up to 100% and then resetting:

Progress bars have percentages for a reason - why do so many software companies defeat the purpose of a progress bar by filling it with false information? But I digress.

Meanwhile, over in my GNS3 VM, I had this worrisome message:

It appeared that GNS3 was trying to connect to its VM, but its VM for some reason was not connected to my home network.

As suggested, I went into the Networking configuration screen in the VM, and was warned that the server would reboot at the end of the process. Okay, sure.

Of course this couldn't just be simple. Oh well, at least I get to use nano instead of vi.

Okay. The file specifies that eth0 is the "host only" interface, and it appears to be set to use DHCP.

"Host only" is a type of VMWare virtual network interface which essentially creates a private LAN between a VM (or several VMs) and its host machine. VMWare should run a DHCP server on this private LAN to assign IPs to any VMs that ask for one.

In this case, however, it appears that this isn't happening.

Next step was to check that the VM itself was configured correctly:

As far as I know, the order that the adapters appear in the VM settings is the same order that they'll appear to the host machine (eth0, eth1, etc.) - so eth0 is in a host-only network as it should be.

As promised, once I closed out of nano, the VM rebooted. Fine.

Once it came back up, I got the same message.

This time, I decided to pull up a shell from the menu and see if I could figure something out from there.

`ifconfig | less`

Okay. Definitely not getting an IP address. Time to dig through log files... GNS3 keeps the ones I'm interested in in /var/log/upstart. In particular, I'm interested in network-interface-eth0.log - which had some helpful information at the end:

For whatever reason, VMWare appeared not to be responding to DHCP requests from the VM.

VMWare runs a service on the host machine called - imaginatively - "VMware DHCP Service." I'd had issues with VMWare services on the host machine before, so I restarted the service to see if that helped, then restarted the VM itself.

It didn't.

I did some more digging, and discovered an annoying quirk of VMWare's virtual network feature:

VMWare has two virtual networks named VMnet0 and VMnet1. They cannot be deleted or renamed.

As it turns out, VMnet0 is the default virtual network for VMs where a "bridged" connection (VM connected directly to the external network) is selected, and VMnet1 is the default virtual network for VMs where a host-only connection is selected. This isn't noted anywhere in the virtual network editor.

What had happened was, I got tired of trying to remember which VMnet was which (remember, they can't be renamed) so I just set them both to host-only, disabled DHCP, and created additional virtual networks that I COULD rename.

Except, now, my GNS3 VM was trying to use VMnet1 by default, which was a "dead" network with DHCP disabled.

So at this point, I deleted my custom network, reset VMnet0 and VMnet1 to their original settings, and rebooted the GNS3 VM.

Finally.

I went back to GNS3, and tried to finish configuration again... shocking, it immediately connected to the VM and asked me what I wanted to do first:

What's Next

Next, I need to create VND "templates" and add my VMs to GNS3. That falls under "customization," so it's going to be the next entry.

Day 2: Building an outpost with DHCP and DNS.

Previously, on Simulcron...

I'm giving up on the VPN thing for now. I suspect my "double NAT" setup is causing problems for IPSec. (Also, I just checked, and for some reason Windows is back to forwarding packets 

Anyways. Thus far on my Win2016 VM, I had ActiveDirectory services and DNS installed. I set up DNS under the "outpost.amateria" domain ("Amateria" is an age from Myst III that I like.)

Next order of business was to set up a DHCP server so I can hand out IP addresses to the VMs on my VMWare LAN.

Oddly, when I went to configure the DHCP server, it failed out with the error "The DHCP service could not contact Active Directory." This error was a little misleading - after doing some digging, I discovered that I'd forgotten to add my user account (that I was using to add DHCP to AD) to the Domain Admins account and that I actually just didn't have permissions. Added myself to Domain Admins and rebooted, and the problem solved itself.

Next step was to actually configure a DHCP scope. The only options I really cared about were the Router (default gateway) and DNS Server options.

With all this done, I decided to go ahead and add a Windows 8 VM to my new domain. Done, and done. I tested and confirmed my new VM has access to the Internet. (I also tested to see if it could send traffic to my VPC. No dice.)

Undecided what to do next...

Day 1.2: VPN troubleshooting

Starting point

This entry has been a couple days in the works. Mainly because I didn't want to be writing up everything I was doing while I was also trying to Google and troubleshoot.

So after all my hard work trying to set up a VPN tunnel, I realized that my local network at home (where my virtual W2016 server had its "external" IP) used part of the same IP range (10.0.0.0/24) as my VPC (10.0.0.0/16).

Moving ahead

I took the easy way out and changed my home network to use a 172.* private address range instead.

Unfortunately, my VPN tunnels still weren't working. EC2 showed them both down. Tracert'ing shows that my VM was trying to route VPC-destined packets into my local network instead of over the VPN tunnel.

I wasn't totally sure what I did last night, so I decided to wipe out RRAS and related roles on W2016 and start from scratch.

Didn't help either. At this point I realized I didn't know nearly enough about IPSec to understand what I was doing, so I put it on hold.

By a lucky coincidence, I happened to be reading about IPSec in my CCNA study guide yesterday, which got me at least a basic understanding of what I was actually trying to do.

Armed with this, I gave it another shot last night.

First realization: I have a NAT router between my home network and the Internet. This is a problem since IPSec is stateless at the network/transport layers. I added port forwarding to the router to make sure the IPSec packets were able to make it back to the VM.

Still no dice. For reference, here's what my setup at home looks like right now:

Don't hate - I made this in PowerPoint, from memory, at work.

So I started running Wireshark on my host machine to watch for packets going to the AWS gateway.

I discovered that packets were making it to the local LAN, but with a source address on the 10.* network. It was at this point that I realized that I never set up NAT on the Win2016 VM like I'd intended (which would have made the Win2016 VM the single entry/exit point for traffic going in/out of the VPN) - so I went ahead and did that. I also set up a static route on the VM to route traffic destined for 10.0.0.0/16 to itself.

Finally, after watching Event Viewer and the Windows Firewall monitor, it looked like I was having some limited success! Windows was negotiating with the VPN gateway and setting up the tunnel successfully.

Unfortunately, watching Wireshark... I noticed that after the VPN tunnel was established, all the data packets headed for the VPN got an ICMP "Port Unreachable" response.

At this point, I found myself wondering if AWS was returning that response as a "translation" that something was misconfigured on the other side of the VPN gateway. (The port shouldn't have been actually unreachable since that's how the tunnel was set up.)

Minor correction to the graphic: at this point, I still had my VM LAN set up as 10.0.2.0/24. I figured I should probably change this to make sure I wasn't having more subnetting issues, so I switched the VM LAN over to 10.1.0.0/16.

For some reason, at this point, the IPsec rule stopped working. I called it a night since it was past midnight.

That's where I'm at now. More to come when I get home...

Day 1.1: Implementing a VPN connection to an "outpost."

Getting Started

VMWare Setup

First thing I need to do, like I described in the design, is set up VMWare with a "virtual network" and then give one VM the ability to talk to the outside world.

Added a "host-only" network, 10.0.2.0/24.

My W2016 VM was already built, so now I just needed to configure it as a go-between:

VM configured with two network adapters: one on the virtual network I just created, the other sharing an IP address with my physical machine.

Once I started up the W2016 VM, it was a little confused, since its configuration wasn't what it was last time it was powered on.

I renamed the connections to match their respective "sides." One of them isn't working, I'm not sure why. I'll tackle configuring the INTERNAL side first.

I've decided my "outpost" subnet is going to be 10.0.2.0/24 and my "hub" is going to be 10.0.2.100. There's no default gateway yet. For now, I'm going to have it use Comcast's DNS servers.

Now to tackle the other problem: Google suggests that this is a problem with using NAT for that interface, so I switched it over to "Bridged." Problem solved.

Setting up the VPC for VPN (!)

I basically just followed this guide: https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/SetUpVPNConnections.html to set up the VPN connection itself (using static IP addressing.)

---

Okay, after all this, I found a major flaw in my plan.

My VPC address range is 10.0.0.0/16.

My internal network here at home is 10.0.0.0/24.

The VPN tunnels aren't working because W2016 is trying to forward traffic destined for the VPC, out over my local network instead of through the tunnel.

I think I'm gonna work on this some more tomorrow.