VPN and internet access

[kjl]

I have an SBS 2000 server and a remote XP client. I'm using a dialup (VPN) connection on a broadband connection to log into the server all works well except for I can't access the Internet. I have read and tried to apply KB article 317025. It states to create a static route using the 1st IP address of static scope from server. I get the error "The route addition failed: either the interface index is wrong or the GW does not lie on the same network as the interface. Here are my settings: Local server network 192.168.10.0 SM 255.255.255.0 VPN static pool 192.168.20.100 thru 149 SM 255.255.255.0. Command I tried to add: route add 192.168.10.0 mask 255.255.255.0 192.168.20.100. If I use the actual IP address that the VPN gets assigned everything work correct. Problem is I have multiple machines connecting and I don't know the address they will get and if the route is not added before logging in I can't run a script from the server because it does not know how to get to the server. How can I fix this?

[Chad A Gross [SBS-MVP]]

Hi kjl -

If this remote client is behind a properly configured firewall that you
control, then your easiest solution is to uncheck the "Use default gateway"
option in the VPN connectoids advanced TCP/IP settings. By unchecking this
option, the remote client will use its local internet connection for
internet access instead of routing internet access through the VPN tunnel.
However, I cannot overstate that unchecking this option poses a security
risk to both the remote client and your entire SBS LAN if the remote client
is not properly configured. Tom Shinder has a good article on this over at
isaserver.org:
http://www.isaserver.org/tutorials/VPN_Client_Security_Issues.html

If you do not have control over the remote client, then I strongly advise
against unchecking the "Use default gateway" option. We can still provide
remote clients internet access through the VPN tunnel. In order to get web
access on the remote VPN client, simply configure the browser on the client
to point to your SBS for it's proxy. In IE, go to Tools | Options. On the
Connections tab, select your VPN connectoid & click Settings. Enter the
internal IP of your SBS and port 8080 for the proxy server and you should be
good to go.

If you need full internet access (e.g. non-proxied access for things like
newsgroups, etc.), then you'll need to install the firewall client on the
remote VPN client, since remote VPN clients cannot be configured as Secure
NAT clients for ISA. The trick here is that the firewall client will cause
problems with local internet access if it is still active when the VPN is
disconnected. Therefore, we'll need to enable the firewall client when the
VPN is connected, and disable the firewall client when the VPN is
disconnected. If you're interested, I can post in some scripts I use that
will enable / disable the firewall client. I then build a custom VPN
connectoid that calls the appropriate scripts when the VPN is connected and
disconnected. The end result is a completely transparent experience for the
end user - and the internet just 'works'

HTH!

--
Chad A Gross [SBS-MVP]

SBS ROCKS!!!

[Merv Porter [SBS-MVP]]

Hey Chad:

> I then build a custom VPN
> connectoid that calls the appropriate scripts when the VPN is connected
and
> disconnected.

Just curious... what does this entail.

(I've captured your "Enable/disable firewall clients" scripts a while back.
Thanks.)

--
Merv Porter [SBS MVP]
===================================
"Chad A Gross [SBS-MVP]" <chad....@laytonflower.nospam.com> wrote in
message news:#44mabEn...@tk2msftngp13.phx.gbl...

[kjl]

Chad,

I would love to see the scripts to enable the ISA Client depending on the connedtion selected. The remote workstations do have the ISA client installed. Please provide the best practice for having remote clients logon to an SBS server. Thanks for all your help.

Kevin

[Chad A Gross [SBS-MVP]]

Hi Merv -

I use the Connection Manager Administration Kit to build the custom VPN
connectoids - very simple & works very slick. When you're building your VPN
connectoid with CMAK, you can specify various actions to run, including
pre-connect, pre-tunnel, post connect & disconnect. I specify the
fcstart.vbs script as the post-connect action and the fcstop.vbs script as
the disconnect action. The CMAK then rolls everything (including the
scripts) into an exe that when ran on the remote machine installs the VPN
connectoid & scripts. In addition, the exe is usually very small (~125kb)
so that is can be easily distributed to remote users via download / floppy.

--
Chad A Gross [SBS-MVP]

SBS ROCKS!!!

Merv Porter [SBS-MVP] wrote:
> Hey Chad:
>
>> I then build a custom VPN
>> connectoid that calls the appropriate scripts when the VPN is
>> connected and disconnected.
>
> Just curious... what does this entail.
>
> (I've captured your "Enable/disable firewall clients" scripts a while
> back. Thanks.)
>

[Merv Porter [SBS-MVP]]

Thanks Chad. I'll have to give this a try.

"Chad A Gross [SBS-MVP]" <chad....@laytonflower.nospam.com> wrote in

message news:#7gV5oLn...@tk2msftngp13.phx.gbl...

[Merv Porter [SBS-MVP]]

And for amyone else who may be interested, here's a web site I found that
has a little more info (and screen shots).

Using the Connection Manager Administrator Kit (CMAK) to STREAMLINE VPN
Client Configuration
http://www.tacteam.net/isaserverorg/vpnkitbeta2/cmak.htm

--
Merv Porter [SBS MVP]
===================================
"Chad A Gross [SBS-MVP]" <chad....@laytonflower.nospam.com> wrote in

message news:#7gV5oLn...@tk2msftngp13.phx.gbl...

[Michael Sadoff [MSFT]]

The solution is to configure RRAS to allow VPN clients to request a
specific IP address when connecting, and then configure a static IP in the
VPN connection properties. That way, you only need to run the "route -p
add" command one time, specifying the VPN client's IP in the last
parameter. To configure RRAS to allow VPN clients to request a specific IP,
open the RRAS console, go to Remote Access Policies, double-click the
remote access policy that applies, click Edit Profile, select the IP tab,
and select the option, "Client may request an IP."

Michael Sadoff
Microsoft SBS Product Support

This posting is provided "AS IS" with no warranties, and confers no rights.