• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Server 2008 VPN setup

M

Manaknight

Supreme [H]ardness
Joined
Jun 6, 2005
Messages
5,446
so i have my server box up and running. Local works great, i hashed out getting users set up with permissions and such. However now my situation becomes more complicated. I am trying to set up vpn so that if i am out of the house, OR one of the friends whom i give acces to wants to use or add files can do so remotely. Also it helps to be able to use their system to render projects i am working on.

Anyway i got it set up in remote and routing, no real issues there, i have it set up to us pptp since i will have a variety of os's accessing and none of the data is anything that is a security concern. Firewall ports are open, and incoming requests are open and forwarded to the box.

on testing i can get onto the box, its reported that the connection is there and it can see which user is logged in. However he cannot view any of the shares that he has permissions to in network places. he also cannot manually enter the server name in his browser \\server\sharedfolders it does not give anything. doesn't work with ip address either. if he drills to it in the command prompt via the ip address he can see it however.

if i do this on the internal side of the network everything works fine. and i can access my shares via browser. I'm sure i'm just missing a step here, but if someone can maybe point out some ideas to see what i missed i would be grateful.

also... i am not running active directory at this time. Just seperate user names and passwords.
 
I am not too familiar with 2008 VPN, but there should be a setting that defines what traffic goes through the VPN connection, and you need to be sure to set that to All. Again, I'm not proficient in this but I would start there.
 
setting all vpn traffic to go through the vpn wont do anythign all it will do is push web traffic through the vpn and slow it up.

You may need to set something in the local hosts file on the CLIENT machine to tell it where to go. You know how to do this?

Also is it assigning DHCP and DNS to the clients correctly? Have you checked the client are getting dns and dhcp from your server via the vpn?

Also server 2008 has a strict firewall and it maybe blocking the users. I've found in mosts cases its down to that. As you have to remember server 2008 is designed with it been sat in a data center open to the world and not nessarily been protected by a hardware firewall, so it can be very strict. So check there too.

Phil
 
Ah yes. I've run into this problem before.

Question 1:
When your user is connecting from a remote location, what is the IP scheme? What is the IP scheme of the servers network?

Question 2:
I'm assuming your firewall serves out IP's? How are addresses served when tunneling? I am not positive about 2008, but 2003 gives you a few options - forward to a DHCP server, assign a block of IP's itself, etc.

The point I'm getting at here - if your servers subnet is 192.168.0.x/24 - and the location where you are remoting in from is ALSO 192.168.0.x/24 you have a problem. The remote users NIC will see a request to connect to the file server on that IP, which it knows to connect locally - so it sends out broadcasts to get its MAC and tries to connect directly. It will not send packets through the tunnel if they are destined for (seemingly) - the same network.

Have you had your user try to ping the servers IP? try to ping via name as well - this will test whether broadcasts are making it.

Within RRAS on server 2003 (I'm assuming 2008 is similar) you have to define what traffic goes in and out, so you would have to define DNS, DHCP, broadcasts, windows file sharing, etc - in both directions, including the reply packets.
 
ok yeah then i missed some steps.

when the user connects they then appear as the server's ip address.

say my internal is 192.168.0.115 and the user connects, i will then see him as .115 and he will see himself as .115 I am not sure what his subnet is, though i will check that. though i will still need to figure that out however, since i'm sure at least one of the 4 or 5 remote locations uses the same routing hardware i use at home...since i set them up.

if i recall it will ping via ip but not name.

to directly answer question:

1. ip's are automatically assigned from a block of ips i set aside for clients. i will probably set the servers so that it is the same all the time.

2. yes my firewall is where the ip's are usually dished out from. like i said, so far when i have successfully connected via vpn the client takes the ip of the server.
 
i'm sure at least one of the 4 or 5 remote locations uses the same routing hardware i use at home...since i set them up.
Click to expand...

Think about routing in general. If your IP address is 192.168.0.35. And your servers is 192.168.0.115. When your computer sends a packet to the server 192.168.0.115 - it will not send it through the tunnel, instead it will do the broadcast to try to find it on your local LAN, and then connect directly.

To fix this - change your servers (and your entire office) to a subnet that is not used by 95% of the worlds consumer routers. (i.e. NOT 192.168.0.x or 192.168.1.x or even 192.168.10.x or 192.168.100.x)

We use 192.168.204.x/21 for ours and it solved that problem mighty quick.

It sounds an awful lot like your very close, just need to get name resolution fixed.
 
You must log in or register to reply here.
Back
Top