It’s been a while since I posted a story, but this one came up in conversation the other day and I figured it was worth sharing.

Back during Covid, when everyone was working remotely, I had an issue escalated to me from our helpdesk.
They’d already gone through the usual steps — repairing the connection, reinstalling the client, testing other credentials — but nothing worked. The user would hit connect, enter their password, and the moment it connected, it would immediately disconnect.

Now, I’ve learned not to blindly trust “I already tried that” because I’ve been burned before when someone skipped the less-obvious step. So, I started checking things myself.

Some background: a few of our older clients had set up their own networks before we came on board. Normally, when we take over, we standardize things — readdress the network, VLAN off cameras and guest Wi-Fi, that sort of thing. But this particular client never went through that process. Their office at the time was literally just a converted residential house, with desks in every room.
That meant their office network was still on 192.168.1.x — the same subnet as the user’s home network.

I ran an IP scan and noticed a device on 192.168.1.254, which happened to be the same address as their office firewall. So the moment the VPN connected, traffic defaulted to the local device instead of tunneling through, and the connection dropped.

The device didn’t have a web interface, and a MAC lookup just came back as some generic manufacturer. But it did respond on Telnet and SSH. After some questioning, we figured out what it was: their robot vacuum cleaner that the user’s husband had set up. Apparently, you’re only supposed to manage it through the app, which explained the lack of a web interface.

I ended up finding default credentials online, SSH’ing into the thing, and readdressing it to resolve the issue.

To this day, I still enjoy watching people’s expressions when I ask:
“Did I ever tell you about the time I had to SSH into a Roomba to fix a VPN issue?”

TL;DR:
When you onboard a client, push harder to change their office network so it’s not sitting on the default subnet.