How do I set up a VPN using Windows Server 2003 and a Netgear DG834 modem?

[InTheCube]

I need to create a VPN, so that remote users can dial in to our company network, to access resources on the network. And I need to do it quickly. I do not need a branch-to-branch VPN.

I have the following:

• Netgear DG834 ADSL modem/router
• ADSL line to be used only for the VPN. No static public IP address on this line, but a DynDNS hostname can be set up easily.
• Windows Server 2003 Standard license
• Intel server with 2 network cards (I assume one will point to the internal network, and one to the router's "network")
• Existing network with +- 40 PCs, devices, servers, etc that we need access to
• No Windows Domain or Active directory

I've been playing around with Routing and Remote Access (RRAS) on the server and the VPN Wizard on the DG834 router, but haven't been successful. I really don't think I can progress until I have answers to the following:

2. Can I set up the VPN only on the DG834, without needing the server?
3. Can I set up the VPN only on the server, without need the VPN features of the router?
4. If I use RRAS, do I need to open ports on the Windows server firewall, or will RRAS handle this automatically? When RRAS is enabled, I can't access the Windows Firewall to set up any inbound or outbound rules.
5. How do I know which VPN protocol to use, that is supported by both the router and the server.
6. What VPN client do I use to dial the VPN connection? Can I use the built in VPN client provided by windows ("Connect to workplace")? I would prefer to set the VPN up without needing to pay for any softare or licenses.

Are there any guides out there that can assist with creating a VPN for the environment I've described above? I've done quite a bit of reading already, but nothing that is comprehensive enough to help me out.

 

[PsyWulf]

You have a choice to use RRAS or Firewall,not both

You use only the VPN features of the server,and port forward the necessary ports and protocols to the server from the router

You also need user accounts and passwords configured on the server,with security permissions to Dial In

Ideally your router should support VPN passthrough protocols - not all of them allow this ( on the Link I posted,the Protocol 47 is VPN passthrough )

http://technet.microsoft.com/en-us/library/cc757501(v=ws.10).aspx

Default type of VPN for server2003 is PPTP,the others require more configuration

 

[InTheCube]

Thanks for the response Psy.

You have a choice to use RRAS or Firewall,not both

So does this imply then that I don't need to worry about opening ports on the Windows Firewall, as RRAS will do it automatically? Or do I still need to open these ports manually somewhere in RRAS?

You also need user accounts and passwords configured on the server,with security permissions to Dial In

What permissions are required to dial in? Is there a special group the users need to be added to?

Ideally your router should support VPN passthrough protocols - not all of them allow this ( on the Link I posted,the Protocol 47 is VPN passthrough )

Apparently all Netgear routers support VPN passthrough by default, so I should be fine.

 

[PsyWulf]

Thanks for the response Psy.
So does this imply then that I don't need to worry about opening ports on the Windows Firewall, as RRAS will do it automatically? Or do I still need to open these ports manually somewhere in RRAS?

RRAS turns off the server firewall pretty much,you'd need new rules configured in RRAS,but it doesn't mater,you're only forwarding allowed ports to it

What permissions are required to dial in? Is there a special group the users need to be added to?

Well on AD there's a Dial-in Tab in the user accounts screen,no idea for server without. Option2 is using a remote access policy and then the users need to be in the remote users workgroup

Apparently all Netgear routers support VPN passthrough by default, so I should be fine.

Aite

 

[Rocket-Boy]

*cough* openvpn *cough*

 

[InTheCube]

*cough* openvpn *cough*

I will consider this later on. For now, I need to get things running quickly, using the tools I currently have. I also have a paid for license for Windows Server 2003.

Don't you still have to pay for a license for OpenVPN?

 

[Rocket-Boy]

No its free: http://openvpn.net/index.php/open-source.html
It will take you 15 mins to setup. I use it across 108 servers made up of windows, linux and mac.
Its still my favorite VPN solution.

 

[InTheCube]

No its free: http://openvpn.net/index.php/open-source.html
It will take you 15 mins to setup. I use it across 108 servers made up of windows, linux and mac.
Its still my favorite VPN solution.

OK.. give me a quick run down of how to set this up. Will this be installed as a new OS image? Or can it run on top of Windows? And how does it relate to my questions in the OP?

 

[Rocket-Boy]

OK.. give me a quick run down of how to set this up. Will this be installed as a new OS image? Or can it run on top of Windows? And how does it relate to my questions in the OP?

Its very simple to use, this explains the setup:
http://openvpn.net/index.php/open-source/documentation/howto.html

Its just software that runs on your windows server. It will give you the remote connectivity and access to network resources work the same as if you are in the office, windows will see it as being a physical network adapter so you can access resources without hassles.

 

[Rocket-Boy]

One thing I forgot to mention is that you would need to open port 1194 on your firewall and forward traffic from your router to the server on port 1194. Its normally UDP depending on how you choose to set it up.

 

[InTheCube]

One thing I forgot to mention is that you would need to open port 1194 on your firewall and forward traffic from your router to the server on port 1194. Its normally UDP depending on how you choose to set it up.

Thanks. For now I will stick with the Windows solution. I think I am making some progress. I will try out OpenVPN when I have some time to mess around with it.

BTW - with OpenVPN, are you using any of the Windows GUI's for the Access Server, or are you just cofiguring it via the config files? If you're using the GUI - which one? There are like 10 different ones available. And is there an OpenVPN client available as well?

 

[Pada]

Just don't use OpenVPN with TCP, because it's latency is then increased dramatically (like twice as much)!
I've never used the standard GUI for OpenVPN, except for quickly stopping & starting the VPN.

We're using OpenVPN between our Linux & Windows machines, because PPTP VPN support in Linux is poor.
On our MikroTik's we're using PPTP VPN, because their OpenVPN only supports TCP.

Then for the high availability connections, we use Cisco routers and IPSec tunnels. We started off with OpenVPN before we had funds to buy the Cisco routers and their licenses (R5k for the license to run IPSec !).