After some time, the LAN connection drops on the Windows 11 VM.

G

gusto

Renowned Member
Feb 10, 2018
122
3
83
26
Apologies—this topic relates to networking, but specifically within the Windows 11 OS. I know many people also use Windows 11 in a VM, so perhaps you can offer some advice.

This is my configuration for QM (on Proxmox VE 9.1.2)

Code: 
qm config 100
agent: 1
bios: ovmf
boot: order=scsi0;ide0;ide2;net0
cores: 4
cpu: host
efidisk0: vmdata:vm-100-disk-0,efitype=4m,ms-cert=2023,pre-enrolled-keys=1,size=1M
ide0: none,media=cdrom
ide2: none,media=cdrom
machine: pc-q35-10.0+pve1
memory: 8192
meta: creation-qemu=10.0.2,ctime=1759250190
name: win11
net0: e1000=XX:24:11:7F:XX:79,bridge=vmbr0
numa: 0
onboot: 1
ostype: win11
scsi0: vmdata:vm-100-disk-1,discard=on,iothread=1,size=128G
scsihw: virtio-scsi-single
smbios1: uuid=XXXXX200-0400-XXXX-0006-000700080009
sockets: 1
tpmstate0: vmdata:vm-100-disk-2,size=4M,version=v2.0
vmgenid: 1927a5fc-xxxx-xxxx-8507-e76d696xxxxx


I have a simple 192.168.100.0/24 network. A Windows VM is running at IP address 192.168.100.8 (there is also a WireGuard network, 10.10.8.10).I have had this Windows 11 OS installed for several months and have been checking whether it functions correctly.When I start the VM, the network works as expected. I can ping the internet, the LAN (192.168.100.0/24), and the WireGuard network (10.10.8.0/24).After some time, only the internet remains accessible; I can no longer ping the 192.168.100.0/24 or 10.10.8.0/24 networks.Sometimes this happens 1–2 days after rebooting the VM, while at other times, the LAN and WireGuard connections continue to work for up to two weeks after a reboot.I suspect the issue lies somewhere within the Windows settings, even though it is a clean installation of Windows 11 Pro 25H2.

I performed the installation following this guide.
 
Maybe I didn't need to mention WG, but since I use WG as well, I mentioned it.
My WG setup on Win 11 is

Code: 
[Interface]
PrivateKey = GOFhaxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxiMeXAFE=
Address = 10.10.8.10/32

[Peer]
PublicKey = fdjMhZ9GzxxxxxxxxxxxxxxxxxxxxxxxSRhlfjslR00=
AllowedIPs = 192.168.100.0/24, 10.10.8.0/24
Endpoint = example.ddns.net:52890
PersistentKeepalive = 25
It is a peculiar case, because the internet works, but the LAN does not.
 
Hmm, what's the gateway(for the vm)? and if 192.168.100.0/24 is the LAN, why would it also be in the wg config? is this VM doing any routing between the two networks?
 
There is a bridge between the physical LAN and the VM. The gateway is 192.168.100.1. I cannot even ping the gateway.
 
So 192.168.100.1 is the default gateway in the VM? Why is 192.168.100.0/24 in allowed IPs?
Code: 
AllowedIPs = 192.168.100.0/24, 10.10.8.0/24
I'm not sure what the windows wg client does, but could you check if it sets up a route for 192.168.100.0/24 through the tunnel?

> The gateway is 192.168.100.1. I cannot even ping the gateway.
you can't reach the gateway, but you can reach the internet?
 
Route table
Code: 
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.100.1    192.168.100.8     25
        10.10.8.0    255.255.255.0         On-link        10.10.8.10      5
       10.10.8.10  255.255.255.255         On-link        10.10.8.10    261
      10.10.8.255  255.255.255.255         On-link        10.10.8.10    261
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
    192.168.100.0    255.255.255.0         On-link     192.168.100.8    281
    192.168.100.0    255.255.255.0         On-link        10.10.8.10      5
    192.168.100.8  255.255.255.255         On-link     192.168.100.8    281
  192.168.100.255  255.255.255.255         On-link     192.168.100.8    281
  192.168.100.255  255.255.255.255         On-link        10.10.8.10    261
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link     192.168.100.8    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link     192.168.100.8    281
Yes, the internet works, but the ping within the LAN does not.
 
This looks like a problem, when you can't reach the LAN, it very likely is windows trying to reach 192.168.100.0/24 through the wireguard tunnel, instead of the local interface. That also explains why everything outside of the subnet is working, because there is not explicit route and it just goes through the default gateway.
Code: 
    192.168.100.0    255.255.255.0         On-link        10.10.8.10      5
so it does look like the windows wg client does generate routes for the configured allowed IPs. Can you remove 192.168.100.0/24 from the AllowedIPs of your wireguard config? The route for 192.168.100.0/24 via 10.10.8.10 should disappear.

This vm does not do any routing between the two subnets though, right?
 
When I try tracert, I see
Code: 
 tracert 192.168.100.2

Tracing route to 192.168.100.2 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.10.8.1
  2     1 ms    <1 ms    <1 ms  192.168.100.2

Trace complete.
I removed the 192.168.100.0/24 subnet from AllowedIPs to see if that was the cause.
thx
 
You must log in or register to reply here.
Top Bottom
Back