Chad
Wed Jul 23 12:54:34 CDT 2003
Hi J -
I was getting ready to drop you a line since I never received your email -
but I'm glad it's working. As for interet access over the VPN, below is a
copy of a post of mine from a couple days ago on the same subject. (For
context, see the thread "OWA access from internet" started by Jeffrey Reed
on 7/21/03)
The source of your problem is that once the VPN is connected, the remote PC
routes all traffic (whether for the SBS LAN or internet) to your SBS. The
easiest (albeit less secure) solution is to configure your VPN connectoid to
not use the default gateway on the remote network. What this does is create
a split-tunneling scenario where LAN traffic is routed over the VPN
connection and internet traffic uses the local internet connection (cable in
your case). The potential security issue is that if an internet-based
attack successfully gained access to the remote client (or it became
infected with a virus), the attacker and/or virus would have direct access
to your SBS LAN with all of the priviliges of the remotely connected user.
Yuck. For more info, check out Tom Shinder's article on split tunnelling
over at isaserver.org:
http://www.isaserver.org/tutorials/VPN_Client_Security_Issues.html
Now if we want to treat this remote client as a LAN client and have all
traffic routed through SBS (ISA), we need to do some configuration changes
on the remote client. Regular web access is easy - just open up IE, go to
Tools | Internet Options | Connections. Select your VPN connection from the
list and click Settings. Check to Use Proxy Server and enter the internal
IP of your SBS and port 8080. If you need full internet access besides just
web browsing (pop3, nntp, instant messaging, etc.) then you'll have to
install the firewall client on the remote client. Unfortunately, VPN
clients cannot be configured as SecureNAT clients in ISA - so our only other
option is to configure them as firewall clients. Ok, so we can install the
firewall client on the remote PC - but if we leave the firewall client
enabled after the VPN is disconnected, the user won't have internet access.
Likewise, the same will be true if we don't enable the firewall client after
connecting via VPN. Luckily, we don't have to rely on the user to remember
to enable / disable the firewall client. By using the Connection Manager Ad
ministration Kit, we can create a custom VPN connectoid and use two simple
scripts to automate the process. Thus the VPN connectoid automatically
enables the firewall client when the VPN is created and disables the
firewall client when the VPN is disconnected with the entire process being
transparent to the user.
Of course, the other item that needs to be taken into consideration is
bandwidth. By routing all internet traffic through the VPN connection, your
internet connection on your SBS is actually doing double-duty by downloading
internet content then sending back out on the same interface to the remote
VPN client. If you're just talking about a few users with typical internet
use (ie web browsing, newsgroups, basic pop mail (barring a significant
number of large attachments) this shouldn't be a problem. If you have a
large number of remote users and/or high traffic demands with those remote
clients, it may be beneficial to have a split-tunnelling scenario. However,
I would strongly suggest that you make sure any remote clients are
thoroughly protected by both a firewall and up-to-date anti-virus before
implementing a split-tunnelling scenario.
--
Chad A Gross
Lerman's Law of Technology: Any technical problem can be overcome
given enough time and money. Corollary: You are never given enough
time or money.
jbiergans wrote:
> ok, think i found the problem. dhcp relay on the wan, i
> uninstalled it and reinstalled it, and i can now log onto
> the network via dial-up. i can browse and ping the
> server, etc. however, i can't surf the web. i set the
> network connection to use the default gateway, and that
> didn't work either. suggestions on this one?
>
>> -----Original Message-----
>> Hi J -
>>
>> Can you post the exact error messages? Also - anything in the event
>> viewer?
>>
>> --
>> Chad A Gross
>>
>> Lerman's Law of Technology: Any technical problem can be overcome
>> given enough time and money. Corollary: You are never given enough
>> time or money.
>>
>>
>>
>> jbiergans wrote:
>>> Ok, did the disable/enable thing and set up RRAS first,
>>> got 3 errors. One is that the default remote access
>>> policy could not be found. One refers to the DHCP relay
>>> agent. And one says installation failed because it could
>>> not find a file.
>>>
>>> I tried to dial-in and it said I couldn't connect because
>>> the protocals didn't match. Well, there's no option for
>>> PPTP in WinXP Home, and no option for PPP in SBS2000...
>>>
>>> Suggestions?
>>>
>>> TIA!
>>>
>>>> -----Original Message-----
>>>> Hi J -
>>>>
>>>> Quick question - just to double-check, are you running ISA or IAS
>>>> (or both :^) ?
>>>>
>>>> I'm not that familiar with IAS, so I can't offer much assistance
>>>> there. As for ISA, there really shouldn't be any problems. My
>>>> server is setup for both VPN and dial-in access. The trick I've
>>>> found is to configure RRAS for dial-in before you configure ISA for
>>>> VPN access. Open RRAS, right-click on your server name and select
>>>> Disable Routing and Remote Access. Once you've disabled RRAS,
>>>> right-click and select to Enable Routing and Remote Access. Follow
>>>> the RRAS wizard and select to configure your server as a dial-in
>>>> server. Once you've finished the wizard, close RRAS and configure
>>>> ISA to allow incoming VPN connections. Voila!
>>>>
>>>>
>
http://www.smallbizserver.net/sbs2000/How_do_I_configure_
>>>> the_server_for_remote_access_with_VPN.aspx
>>>>
>>>> --
>>>> Chad A Gross
>>>>
>>>> Lerman's Law of Technology: Any technical problem can be overcome
>>>> given enough time and money. Corollary: You are never given enough
>>>> time or money.
>>>>
>>>>
>>>>
>>>> jbiergans wrote:
>>>>> Ok, I've posted about an error I'm receiving twice, and
>>>>> haven't had any help there. So, I'm changing tactics.
>>>>>
>>>>> I'm trying to set up a modem as a backup RAS connection
>>>>> (like for in case the T1 goes down). I can connect to
>>>>> the server via TS and VPN as it is right now when I'm
>>>>> connected to my ISP. I want to be able to dial directly
>>>>> into the server. It does have a modem and the modem does
>>>>> answer. I'm also running IAS on this server. I've read
>>>>> everything I could find on setting up a modem for RAS,
>>>>> and nothing has helped.
>>>>>
>>>>> Does anyone have any suggestions as to where I can find
>>>>> documentation on setting up a modem for dial-in with
>>>>> SBS2000 and IAS?
>>>>
>>>>
>>>> .
>>
>>
>> .