Wednesday, December 7, 2011
Configure a Windows Server 2003 VPN on the server
Add the Remote Access/VPN Server role to your Windows Server 2003 system
To add the Remote Access/VPN Server role, go to Start | All Programs |Administrative Tools | Configure Your Server Wizard. The first screen of this wizard isfor informational purposes only and, thus, is not shown here. Click Next. Thesame goes for the second screen, which just tells you some things you need tohave completed before adding new roles to your server.
On thethird screen of the wizard, entitled Server Role, you're presented with a listof available roles for your server along with column that indicates whether ornot a particular role has been assigned to this machine. Figure A shows you a screen from a server on which just the IIS Webserver role has been added.
To add a new role, select the role and click Next
To add theRemote Access/VPN Server role to your server, select that role and click theNext button to move on to the next screen in the wizard, which provides youwith a quick overview of the options you selected.
The summary screen is pretty basic for this role
Take note: This selection just starts anotherwizard called the Routing and Remote Access Wizard, described further below.
The Routing and Remote Access Wizard component
Like mostwizards, the first screen of the Routing and Remote Access wizard is purelyinformational and you can just click Next.
The secondscreen in this wizard is a lot meatier and asks you to decide what kind ofremote access connection you want to provide. Since the goal here is to set upa PPTP-based VPN, select the "Virtual Private Network VPN and NAT"selection and click Next.
Select the VPN option and click Next
The nextscreen of the wizard, entitled VPN Connection, asks you to determine whichnetwork adapter is used to connect the system to the Internet. For VPN servers,you should install and use a separate network adapter for VPN applications. Networkadapters are really cheap and separation makes the connections easier to secure.In this example, I've selected the second local area network connection (see Figure D), a separate NIC from the onethat connects this server to the network. Notice the checkbox labeled"Enable security on the selected interface by setting up Basic Firewall"underneath the list of network interfaces. It's a good idea to enable sinceoption it helps to protect your server from outside attack. A hardware firewallis still a good idea, too.
Select the network adapter that connects your server to the Internet
With theselection of the Internet-connected NIC out of the way, you need to tell theRRAS wizard which network external clients should connect to in order to accessresources. Notice that the adapter selected for Internet access is not anoption here.
Select the network containing resources needed by external clients
Just likeevery other client out there, your external VPN clients will need IP addressesthat are local to the VPN server so that the clients can access the appropriateresources. You have two options (really three รข€" I'll explain in a minute) forhandling the doling out of IP addresses.
First, youcan leave the work up to your DHCPserver and make the right configuration changes on your network equipment forDHCP packets to get from your DHCP server to your clients. Second, you can haveyour VPN server handle the distribution of IP addresses for any clients thatconnect to the server. To make this option work, you give your VPN server arange of available IP addresses that it can use. This is the method I prefersince I can tell at a glance exactly from where a client is connecting. Ifthey're in the VPN "pool" of addresses, I know they're remote, forexample. So, for this setting, as shown in FigureF below, I prefer to use the "From a specified range ofaddresses" option. Make your selection and click Next.
User configuration
By default,users are not granted access to the services offered by the VPN; you need togrant these rights to each user that you want to allow remote access to yournetwork. To do this, open ActiveDirectory Users and Computers (for domains) or Computer Management (forstand alone networks), and open the properties page for a user to whom you'dlike to grant access to the VPN. Select that user's Dial-In properties page. Onthis page, under Remote Access Permissions, select "Allow access". Notethat there are a lot of different ways to "dial in to" a WindowsServer 2003 system; a VPN is but one method. Other methods include wirelessnetworks, 802.1x, and dial-up. This article assumes that you're not using theWindows features for these other types of networks. If you are, and you specify"Allow access", a user will be able to use multiple methods to gainaccess to your system. I can't go over all of the various permutations in asingle article, however.
