Home / server / Questions / 86850
Accepted
Chris Kooken
Asked: 2009-11-21 16:54:18 +0800 CST

RRAS VPN Server on Windows 2008 Behind NAT

  • 772

Ok, so I have kind of a funky setup, let me see if I can describe it.

I have a single VMware host with a public IP address 74.xx.xx.x Inside that host, I have 3 VM's

  1. Web Server - 1 NIC - 192.168.199.20
  2. SQL Server - 1 NIC - 192.168.199.30
  3. RRAS/VPN Server - 2 NICs 192.168.199.40 & 192.168.199.45

Due to Limitations of my ISP, all of the VM's are connected to the host VIA NAT. I have NAT setup for the webserver so all incoming requests on 74.xx.xx.x via port 80 route to 192.168.199.20. This works fine.

Now I want to set up a Windows 2008 VPN server inside this NAT network and forward the correct traffic to it. My questions are as follows?

  1. What are the TCP/UDP ports that i have to forward?
  2. What special configuration is needed on the server and clients since this is behind a NAT
  3. Any other advice would be wonderful.
windows-server-2008

1 Answers

  1. Best Answer

    Your setup is no different than how many physical RRAS servers are set up including my own at a small office. If you're talking an RRAS VPN you're more than likely talking about a PPTP VPN... unless you have an internal CA and want to futz around with IPSec. (Hint: If you want to futz around with IPSec VPNs, don't. Get an SSL VPN appliance if security is on your mind.)

    Simply forward TCP port 1723 and IP Protocol 47 (GRE) to your RRAS server and you're good to go. Also note that you need to edit / add a Remote Access Policy to allow incoming connections. If I recall correctly, by default no incoming connections are allowed. For instance, I created a group called "VPN Users" and then created a policy called "Corp VPN Policy" that has policy conditions set to allow connections if any incoming request is from a user account that is in that group (as well as making sure that only MS-CHAPv2 PWD is being used, but I digress...). You must elevate that policy higher than the default policy which will deny everything. All of this is done in the "Routing and Remote Access" portion of "Network Policy and Access Services" within Server Manager.

    There is no special configuration needed on the clients. Windows's built in VPN client will work like a charm. I've even used Linux machines and pptpclient to connect to it with smashing success.

    Now, after typing all of this I realized that this was all true for my Server 2003 RRAS box and you said you had a Server 2008 machine. Your mileage may vary. =)

    • 1