'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Microsoft Tunnel Gateway Internal Network Accessibility Error
Question details
Users are experiencing internal network accessibility failures when connecting mobile devices through Microsoft Tunnel Gateway.
- Product
- Microsoft Tunnel Gateway / Microsoft Intune
- Device & OS
- Android and iOS
- Scenario
- Connecting mobile devices to internal corporate network resources via Microsoft Tunnel Gateway.
- Observed behavior
- Devices successfully connect to the gateway but cannot reach internal resources. The gateway health check reports an internal network accessibility failure indicating that return traffic is missing.
Before making configuration changes, ensure you have administrative access to the Microsoft Intune admin center, SSH access to the Linux server hosting the Tunnel Gateway, and the ability to view your internal network's routing and firewall logs.
Verify Network Routing and Firewall Rules
The most common cause of missing return traffic is improper routing or a firewall blocking the internal resources from communicating back to the Tunnel Gateway.
When the health check reports missing return traffic, it means the request from the mobile client is reaching the internal network, but the response is either not generated or cannot find its way back to the gateway.
Review your network firewall policies to ensure bidirectional traffic is allowed between the Microsoft Tunnel Gateway host and the target internal subnets.
Confirm that your internal network routers or switches have the correct static or dynamic routes configured so that internal resources know how to route return traffic back to the gateway's IP address.
Access the Linux server hosting the Tunnel Gateway and confirm that IP forwarding is enabled in the kernel settings (sysctl).
Check your Network Address Translation (NAT) configurations to ensure traffic is correctly translated between the mobile clients, the gateway, and the internal network.
Validate Microsoft Tunnel Configuration and Prerequisites
Ensure the gateway configuration in Intune correctly defines the target internal networks and that your server meets Microsoft's prerequisites.
Review Gateway Logs and Seek Advanced Support
If network settings appear correct, exporting and reviewing the gateway logs can identify specific container or traffic drop issues.
Simplify Your Workflow with a Lightweight Office Alternative
While resolving enterprise network and gateway routing issues can be highly technical and time-consuming, your everyday document tasks shouldn't be. WPS Office is a highly compatible, free, and lightweight alternative to Microsoft Office, perfect for seamless cross-platform document management without complex configurations.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install and Launch: Run the installer, follow the simple on-screen instructions, and launch the application.
- 3. Open Your Documents: Drag and drop your existing Microsoft Office files directly into WPS Office to start working immediately.
Frequently Asked Questions
Why does the Microsoft Tunnel health check report missing return traffic?
This error typically occurs when the internal network lacks a proper route back to the Microsoft Tunnel Gateway server, or when an internal firewall is blocking the return network packets from reaching the gateway.
What are the OS requirements for hosting Microsoft Tunnel Gateway?
Microsoft Tunnel Gateway requires a supported Linux distribution, such as Red Hat Enterprise Linux (RHEL) or Ubuntu, and utilizes container runtimes like Podman or Docker depending on Microsoft's current prerequisites.
Can split tunneling misconfigurations cause accessibility errors?
Yes. If the internal IP ranges are not correctly specified in your Intune split tunneling configuration, the mobile devices will not route the traffic through the VPN tunnel, resulting in an inability to reach those internal resources.
How do I export logs for Microsoft Tunnel Gateway?
You can export the logs by connecting to the Linux server hosting the gateway via SSH and running the 'mst-cli server logs' command. This generates an archive of diagnostic data that can be analyzed or sent to Microsoft Support.
