Click here to get back home

RDP over VPN to Windows Server 2008

 HomeNewsGroups | Search
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
RDP over VPN to Windows Server 2008 Scott S. 11-05-2008
Posted by Scott S. on November 5, 2008, 11:46 am
Please log in for more thread options
Hello,

I work in a small office (11 people) where many of us do several different
jobs.
I myself generally do most of the IT type stuff as well os my "real" job.

Because of that we often need to do things when we aren't in the office, so
a couple years ago I installed a NetGear VPN router (FVS338). I had a devil
of a time getting the VPN Client software to give me a usable connection. I
eventually got it to work, though it likely isn't an optimal solution.

The salespersons can VPN in from their laptops and use CRM which connects to
an internal server, other can VPN in and get tot he SQL Server, and I can VPN
from home and manage the servers. At least until I added a Windows Server
2008 machine. For some reason it doesn't respond to anything coming through
the VPN.

I can ping and RDP to the Win2008 Server from my work desktop, but can't do
either from a laptop connected to the LAN using VPN. I thought it was
probably a firewall thing and temporarily shutdown windows firewall to test
that, but it still didn't respond to ping or other connections.

The internal LAN uses 192.168.2.x subnet, but each VPN client has their own
subnet that I started assigning sequentially from 192.168.5.x to
192.168.14.x. As I said above, this is probably not optimal, and it is a bit
of a pain to setup each machine's VPN Client, but I just couldn't get it to
work any other way.

I hope there is a simple solution involving a configuration change on the
Win2008 box, but if not, I am more than willing to consider other more
sophisticated solutions inculding setting up a "real" VPN server if it would
allow XP and Vista laptops to use the built in VPN ability to connect to the
LAN and get an actual internal IP address.

Thanks,
Scott

Posted by S. Pidgorny on November 6, 2008, 2:48 am
Please log in for more thread options
Not enough information. The server's Windows firewall may be
suppressing the VPN clients - tried to disable that? Can you connect
from the server to VPN clients? What does tracert show and how that's
different from connections to W2K3 servers?

--
Svyatoslav Pidgorny, MCSE, RHCE
-= F1 is the key =-

Scott S. wrote:
> Hello,
>
> I work in a small office (11 people) where many of us do several different
> jobs.
> I myself generally do most of the IT type stuff as well os my "real" job.
>
> Because of that we often need to do things when we aren't in the office, so
> a couple years ago I installed a NetGear VPN router (FVS338). I had a devil
> of a time getting the VPN Client software to give me a usable connection. I
> eventually got it to work, though it likely isn't an optimal solution.
>
> The salespersons can VPN in from their laptops and use CRM which connects to
> an internal server, other can VPN in and get tot he SQL Server, and I can VPN
> from home and manage the servers. At least until I added a Windows Server
> 2008 machine. For some reason it doesn't respond to anything coming through
> the VPN.
>
> I can ping and RDP to the Win2008 Server from my work desktop, but can't do
> either from a laptop connected to the LAN using VPN. I thought it was
> probably a firewall thing and temporarily shutdown windows firewall to test
> that, but it still didn't respond to ping or other connections.
>
> The internal LAN uses 192.168.2.x subnet, but each VPN client has their own
> subnet that I started assigning sequentially from 192.168.5.x to
> 192.168.14.x. As I said above, this is probably not optimal, and it is a bit
> of a pain to setup each machine's VPN Client, but I just couldn't get it to
> work any other way.
>
> I hope there is a simple solution involving a configuration change on the
> Win2008 box, but if not, I am more than willing to consider other more
> sophisticated solutions inculding setting up a "real" VPN server if it would
> allow XP and Vista laptops to use the built in VPN ability to connect to the
> LAN and get an actual internal IP address.
>
> Thanks,
> Scott


* http://sl.mvps.org * http://msmvps.com/blogs/sp *

Posted by Scott S. on November 17, 2008, 11:56 am
Please log in for more thread options
Thanks for the guidance. Sorry I took so long to get back to you ... my
father-in-law passed away so I've been out of the office a bit.

As I stated in my post, I did try it with the Firewall turned off.

I have since tried pinging and using tracert in both directions from the
laptop, Win2k3 Server and the Win2k8 Server.
From the laptop there was no difference, except for the failure to contact
the 2k8 server.
The 2k8 server's tracert appeared to be attempting to sending directly to
the Internet. Looking closer I realize that machine has 2 NICs, 1 with is
directly connected to the Internet. So I added a route:
route add 192.168.0.0 MASK 255.255.0.0 192.168.2.1

After that I could then get pings and tracert to work in both directions
between the Win2k8 Server and the laptop, but RDP still fails.

I tried again with the firewall off, but it still fails. I can connect to
every other Windows server on the LAN using Remote Desktop, just not the new
Windows 2008 Server. Yet I can ping the machine. And when I do try to
connect, the failure is immediate, unlike before when it would try for a
while before timing out.

So at this point I don't know if the firewall is an issue, but something
else certainly is. Could it be the RDP server itself denying connections
based on subnet?

Thanks,
ScottS

"S. Pidgorny" wrote:

> Not enough information. The server's Windows firewall may be
> suppressing the VPN clients - tried to disable that? Can you connect
> from the server to VPN clients? What does tracert show and how that's
> different from connections to W2K3 servers?
>
> --
> Svyatoslav Pidgorny, MCSE, RHCE
> -= F1 is the key =-
>
> Scott S. wrote:
> > Hello,
> >
> > I work in a small office (11 people) where many of us do several different
> > jobs.
> > I myself generally do most of the IT type stuff as well os my "real" job.
> >
> > Because of that we often need to do things when we aren't in the office, so
> > a couple years ago I installed a NetGear VPN router (FVS338). I had a devil
> > of a time getting the VPN Client software to give me a usable connection. I
> > eventually got it to work, though it likely isn't an optimal solution.
> >
> > The salespersons can VPN in from their laptops and use CRM which connects to
> > an internal server, other can VPN in and get tot he SQL Server, and I can
VPN
> > from home and manage the servers. At least until I added a Windows Server
> > 2008 machine. For some reason it doesn't respond to anything coming through
> > the VPN.
> >
> > I can ping and RDP to the Win2008 Server from my work desktop, but can't do
> > either from a laptop connected to the LAN using VPN. I thought it was
> > probably a firewall thing and temporarily shutdown windows firewall to test
> > that, but it still didn't respond to ping or other connections.
> >
> > The internal LAN uses 192.168.2.x subnet, but each VPN client has their own
> > subnet that I started assigning sequentially from 192.168.5.x to
> > 192.168.14.x. As I said above, this is probably not optimal, and it is a
bit
> > of a pain to setup each machine's VPN Client, but I just couldn't get it to
> > work any other way.
> >
> > I hope there is a simple solution involving a configuration change on the
> > Win2008 box, but if not, I am more than willing to consider other more
> > sophisticated solutions inculding setting up a "real" VPN server if it would
> > allow XP and Vista laptops to use the built in VPN ability to connect to the
> > LAN and get an actual internal IP address.
> >
> > Thanks,
> > Scott
>
>
> * http://sl.mvps.org * http://msmvps.com/blogs/sp *
>

Posted by mosesvas on November 11, 2008, 5:59 am
Please log in for more thread options
> Hello,
>
> I work in a small office (11 people) where many of us do several differen=
t
> jobs.
> I myself generally do most of the IT type stuff as well os my "real" job.
>
> Because of that we often need to do things when we aren't in the office, =
so
> a couple years ago I installed a NetGear VPN router (FVS338). =A0I had a =
devil
> of a time getting the VPN Client software to give me a usable connection.=
I
> eventually got it to work, though it likely isn't an optimal solution.
>
> The salespersons can VPN in from their laptops and use CRM which connects=
to
> an internal server, other can VPN in and get tot he SQL Server, and I can=
VPN
> from home and manage the servers. =A0At least until I added a Windows Ser=
ver
> 2008 machine. =A0For some reason it doesn't respond to anything coming th=
rough
> the VPN.
>
> I can ping and RDP to the Win2008 Server from my work desktop, but can't =
do
> either from a laptop connected to the LAN using VPN. =A0I thought it was
> probably a firewall thing and temporarily shutdown windows firewall to te=
st
> that, but it still didn't respond to ping or other connections.
>
> The internal LAN uses 192.168.2.x subnet, but each VPN client has their o=
wn
> subnet that I started assigning sequentially from 192.168.5.x to
> 192.168.14.x. =A0As I said above, this is probably not optimal, and it is=
a bit
> of a pain to setup each machine's VPN Client, but I just couldn't get it =
to
> work any other way.
>
> I hope there is a simple solution involving a configuration change on the
> Win2008 box, but if not, I am more than willing to consider other more
> sophisticated solutions inculding setting up a "real" VPN server if it wo=
uld
> allow XP and Vista laptops to use the built in VPN ability to connect to =
the
> LAN and get an actual internal IP address.
>
> Thanks,
> Scott

Windows server 2008/xp/vista has support for teredo using which u can
access ur office directly over internet.. U can use remote assistance
in vista/2008 or third party http://www.lanoninternet.com to access a
pc resource over internet..AS RDP is already encrypted u can safely
use it over internet...

Posted by Scott S. on November 17, 2008, 12:01 pm
Please log in for more thread options
I read up on Teredo, but since we don't use IPv6 it doesn't appear to be a
solution.
Also, since many different machines need to be connected to, and few have a
public IP, it isn't possible to make RDP directly accessible from the
Internet to each.
Remote assistance required someone in the office to initate, and the whole
point is I need access when I'm not in the office, and that is typically when
the office is closed (evenings, nights, and weekends).

"mosesvas" wrote:

> > Hello,
> >
> > I work in a small office (11 people) where many of us do several different
> > jobs.
> > I myself generally do most of the IT type stuff as well os my "real" job.
> >
> > Because of that we often need to do things when we aren't in the office, so
> > a couple years ago I installed a NetGear VPN router (FVS338). I had a devil
> > of a time getting the VPN Client software to give me a usable connection. I
> > eventually got it to work, though it likely isn't an optimal solution.
> >
> > The salespersons can VPN in from their laptops and use CRM which connects to
> > an internal server, other can VPN in and get tot he SQL Server, and I can VPN
> > from home and manage the servers. At least until I added a Windows Server
> > 2008 machine. For some reason it doesn't respond to anything coming through
> > the VPN.
> >
> > I can ping and RDP to the Win2008 Server from my work desktop, but can't do
> > either from a laptop connected to the LAN using VPN. I thought it was
> > probably a firewall thing and temporarily shutdown windows firewall to test
> > that, but it still didn't respond to ping or other connections.
> >
> > The internal LAN uses 192.168.2.x subnet, but each VPN client has their own
> > subnet that I started assigning sequentially from 192.168.5.x to
> > 192.168.14.x. As I said above, this is probably not optimal, and it is a bit
> > of a pain to setup each machine's VPN Client, but I just couldn't get it to
> > work any other way.
> >
> > I hope there is a simple solution involving a configuration change on the
> > Win2008 box, but if not, I am more than willing to consider other more
> > sophisticated solutions inculding setting up a "real" VPN server if it would
> > allow XP and Vista laptops to use the built in VPN ability to connect to the
> > LAN and get an actual internal IP address.
> >
> > Thanks,
> > Scott
>
> Windows server 2008/xp/vista has support for teredo using which u can
> access ur office directly over internet.. U can use remote assistance
> in vista/2008 or third party http://www.lanoninternet.com to access a
> pc resource over internet..AS RDP is already encrypted u can safely
> use it over internet...
>

Similar ThreadsPosted
Windows 2008 CA can't issue to Windows 2003 server June 25, 2008, 11:53 am
Windows Server 2008 UAC April 1, 2009, 8:01 am
Windows 2008 Server Security May 18, 2009, 1:46 pm
Re: Setting up LDAPs on Windows Server 2008 March 5, 2009, 5:04 pm
Can not get machine certificate from CA on Windows Server 2008 March 28, 2009, 5:57 am
Reposting my request Windows Server 2008 Contributor for book February 21, 2008, 3:46 pm
The security of this directory server can be significantly enhanced - windows 2008 June 12, 2008, 7:32 pm
Setting up Secure LDAP (LDAPS) on Windows Server 2008 March 8, 2009, 12:37 pm
Re: Setting up Secure LDAP (LDAPS) on Windows Server 2008 April 17, 2009, 3:57 am
Windows Server 2008: File disappears from user's view after saving April 1, 2009, 11:46 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Driving a better car - Fuelzilla.com

Cabling site for homeowners and pros alike - Cabling-Design.com

Friends:

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap