RRAS: VPN Routing and Packet Filtering

[Stevehewitt]

P.S: This is a double post. Sorry, but the VPN forum looks pretty dead!

--------------------------------------------------------

Hi Guys,

Got a Windows 2003 Server with RRAS installed and working for VPN using PPTP.

Everything is working fine, with encrypted VPN traffic coming in past our firewall, hitting NIC1 on our RRAS box and connecting.

Essentially, as far as RRAS is concerned, NIC1 is VPN inbound traffic.
What I really want to do, is setup RRAS so that all NIC1 traffic is packet filtered using Windows. E.G I only want ports 3389 and 53 to be accessible for our VPN clients.

I have another NIC (NIC2). Whilst both NIC's are technically on the same subnet and plugged into the same switch, once NIC1 get the VPN inbound traffic I want it to route it all to NIC2, with packet filtering in between. (for packets out of NIC1 to NIC2. NIC2 to NIC1 doesn't need to be packet filtered)

So is there a way for me to get the NIC1 inbound VPN traffic, packet filter it and then shove it out over NIC2?

Cheers in advance,




Steve.

"They have the internet on computers now!" - Homer Simpson

 

[tfg13]

Steve,
I started thinking about this, came up with this:

Could you use IPSec for the filtering? You got me on the "transfer" of data to NIC2 though. I started thinking of persistant routes, but really don't think that would do it. Then I started thinking of a hardware solution, but why have another piece of hardware if you have 2 NICs.

Maybe I'm making it more difficult (maybe you too?) then it needs to be....

 

[Stevehewitt]

Hi tfg13,

Yeah, i'm getting a bit stuck really. I was thinking of a persistant route, forcing all packet that come in on the VPN in NIC to route to the LAN NIC, and then use the Windows packet filter to block all other than DNS/RDP - but I can't seem to get it working.

I'll probably end up cheating, and put the box in our DMZ, inbound to the DMZ to allow PPTP and GRE, and outbound is only RDP/DNS I suppose - got other issues that make me not want to do it that way but I guess it's the most obvious answer right?!

Cheers for the reply!




Steve.

"They have the internet on computers now!" - Homer Simpson