IP Addressing

[jakess]

Maybe the main man ShackDaddy can help me here:

What IP addressing method would i use with SBS in the main office and remote clients via VPN.
DHCP on SBS for local lan pc's i assume, but what for the remote clients using VPN connection.
I dont think NAT will be used at the main office.

 

[TechSoEasyMVP]

NAT will most definitely be used at your main office with SBS. You certainly don't want to have your LAN exposed directly to the Internet.

The recommended IP Subnet for SBS is 192.168.16.0/24 (the /24 signifying that your subnet mask will be 255.255.255.0 providing you with 254 IP addresses). And the recommended IP for the server is 192.168.16.2.

Keeping within these standards does a couple of things...

1. Many home routers use subnets such as 192.168.0.0, or 192.168.0.1, etc. If you use one of these, you will have problems for users trying to connect to your network via VPN if their home network is the same.

2. You'll find a lot of the SBS documentation both by Microsoft and the SBS Community use this IP methodology. I think that it's easier to keep within the best practices realm whenever possible with SBS so that you can more easily get support when needed.

You'll find a great example of a TWO NIC configuration (which I recommend whenever it's possible to do) here:

http://sbsurl.com/twonics

Jeffrey B. Kane
TechSoEasy

http://www.techsoeasy.com

 

[NJForensics]

Are the remote clients via point-to-point tunnel in another location, or are they using some form of individual vpn client?

As for recommeneded subnets, the only reason to stay away from default 1.x network is to avoid conflicts with remote client network (like Jeff said). In that case, the worst case scenario (unless you have some firewall device doing split-tunneling) is that the remote clients won't be able to access the internet locally on their workstations. There is no documented best ip scheme with respect to a SBS or the specific server ip address. It would work just fine on a 1.x network as it would with a 16.x network.

If you have a decent firewall you should just put the remote clients on a different subnet altogether and set a route to allow traffic through on that subnet to your internal company network. Lot's of people like to use a 172.16.x.x but it entirely up to you. (Make sure you open up 53 for DNS over the tunnel)

Chris Clancy, EnCE,CCE

http://www.milestechnologies.com