Remote VPN Server Won’t Come Back Online After a Reboot
Asked by
MellowCedar47
I'm the solo IT person for an underfunded healthcare organization, and I rebooted a VPN server about 250 km away to apply patches. It has been offline for roughly an hour, and the problem is that the VPN is also my only route to the server's iDRAC and management network. I'm debating whether to start a long drive or just accept my fate. Has anyone dealt with a similar remote-access failure, and what would you put in place to prevent it?
Answers
This is exactly the kind of situation where out-of-band access pays for itself. A cellular KVM, Opengear-style console device, firewall-hosted management VPN, or even a small jump box on the site would let you reach iDRAC without depending on the main VPN server.
Reply to this answer
If the server is running an older Windows version, updates and reboots can take much longer than expected, especially on older hardware. I’ve seen update cycles appear dead for hours before finally completing, so checking the hypervisor console or getting someone onsite to look for a boot prompt is worthwhile.
RidgeFox14: Remote servers can also stop at something ridiculous like a keyboard error, battery warning, or power-on prompt. A local person checking the screen and unplugging a bad peripheral can sometimes avoid a full service call.
Reply to this answer
Do you have anyone onsite who can connect a laptop to the right VLAN? Even a trusted employee using Quick Assist or another remote-support tool could give you a temporary path back in and save the road trip.
MellowCedar47: That ended up being the solution. I used Microsoft Live Response to get Tailscale running on another machine on the same VLAN, then reached the environment through that. The VPN VM had failed to start automatically.
Reply to this answer
Once you’re back in, remove the single point of failure. Put the emergency VPN on the firewall or a separate small device, keep management access on an independent path, and consider a cellular OOB unit or remotely controllable PDU for power cycling. A spare jump box on the management VLAN would be a low-cost backup too.
MellowCedar47: That’s the plan. The organization is already upgrading the environment, and a new firewall with VPN support has been ordered. I’m also adding additional remote-management options so the next reboot doesn’t depend on one VM.
Reply to this answer
Add your answer
Answers are reviewed before publication.
CopperLark61: A cheap secondary device running WireGuard or Tailscale on the branch router can also work. It doesn’t need to be elaborate—just make sure it is independent of the primary VPN path.