VPN Server??

[MattWray]

I have a server that is running DHCP, DNS and active directory. It is also acting as a router for the network. Is it possible for me to set up VPN thru this server or do I need another one?

Matt Wray

 

[mark01]

I believe it is possible, unless you are using NAT. If you are running NAT, there might be a way to get around it, but I don't know.

 

[AlexIT]

You should be able to set up VPN too. In the RRAS install and configure this option. The VPN requires the ability to assign from your DHCP pool to outside clients, so make sure you have enough left. I am not using the Win2K server for VPN myself, but I thought there weren't any problems running these two in RRAS at once.

Alex

 

[jasonhand]

Yes, the Routing and Remote access can be setup to do VPN. It works well, though I would put it behind a firewall.

-Jason Hand

 

[MattWray]

How would I go about setting up the VPN option, while the RRAS is using the server as a router?

Matt Wray
CCNA

 

[MattWray]

Alex, in an earlier post with my DNS probs you said :
"If all these steps check out, then you are good to go. If you are worried about security in this case, then your firewall/router isn't good enough.
In extreme security cases, I would suggest placing TWO dual homed servers after the firewall, first is member server still with DNS, DHCP, and NAT plus IP packet-filter software, second is AD server with DNS and DHCP. Now you could set one IP address scope in firewall, one IP address scope in packet-filter server, and your ordinary network scope in AD server. Anyone compromising the firewall, and the packet-filter server must be sitting at the desk NEXT to you, cause they are NOT coming in from outside.

Could I set up a second server as you said and have it running the VPN RRAS? IE: DSL > Router > VPN server with filters > Domain Controller > LAN.
What do you think?

Matt Wray
CCNA

 

[AlexIT]

Matt,

You can set up the RRAS server in between the firewall and your AD server, but this box would still need to run NAT (to get packets from the NAT in the AD server out to the internet.) And then you couldn't connect to your AD server (as it is using NAT to protect itself from that WAN NIC), you could ONLY connect to the RRAS server. I'd only suggest this arrangement for a serious security concern. Put the RRAS on your AD and NAT server and your outside clients can access the whole domain.

Alex