Trust domains from different subnets

[admindude]

I have a Cayman router w/ 5 static IPs. On one of those IPs I have a PDC. On another one of the static IPs I've connected an SMC router w/NAT. I want to be able to establish a trust between the two PDCs.
I was able to setup a VPN from the PDC behind the SMC router w/NAT to the PDC attached to the Cayman, and though I couldn't browse the PDC, I was able to Map a drive to one of its folders that I intentionally shared for this test.
So I can setup communications between the two servers with RAS/VPN devices, but this just seems like a lame way of doing this. Both routers sit next to each other and both share the same WAN default gateway.
What I'm ultimately trying to do here is have two groups of users were Group A only accesses Server A, and Group B accesses both Servers A & B. I'm doing this because I need to run two instances of the same program, but they have to be on different subnets so that the one instance is not aware of the other instance.
Still a neophyte (neobyte?) after all these years!

 

[BradSQLGuy]

Okay I don't think I fully understand what you're asking for. Is this a connectivity issue? It sounds to me like you want to set up a 1-way trust from A to B. Therefore A (trustee) must trust domain B(trusted)if domain B wants access to A's resources. If i'm totally off the mark please tell me. -Brad
A+, MCSE NT4, MCDBA SQL7

-Best cartoon of all time :-D 'Spongebob Squarepants' :-D

 

[admindude]

Yes, I do want to establish a trust. As I said, I can establish a PPTP connection to the PDC behind the NAT (SMC uses what they call Virtual Server where you identify the protocol, incoming port, and destination machine) but I don't think I've ever heard of anyone setting up trusts over a VPN. I've set up trusts between machines on the same LAN segment no problem. The thing here too is that the dialog box for setting up trusts is looking for a UNC name. I'd have to have the connection in place along with NetBIOS for all this to happen.
I guess what I have to figure out is what ports to open on the SMC to establish proper communication. Ports 137, 138, and 139 would probably be necessary...I was just hoping to have minimal exposure for the PDC behind the NAT. I suppose I could try the trust over VPN...gonna be pretty slow though. Thanks for your input. dm