I have a remote retail store which used to be on a hardware VPN (the hardware recently failed and we are looking at upgrading so we don't want to replace it right away). They only need occasional access to the shared drives so I was going to set them up with the ability to log in remotely through the vpn connection allowed by windows. However, the store user is a shared logon and many people have this password. I don't want them to be able to log in to the vpn except from the store, which has a static IP. Is there some way to limit the connection for a specific user to a specific IP address?
4 Answers
I would try to do this on the firewall. But with PPTP 'Routing and Remote Access'. You can set this under the IP tab of 'Remote Access Policies' with the 'Input Filters'
answered Jun 16, 2009 at 14:10
Set it up on the firewall. Not the Windows firewall but the primary Internet facing one. There is no reason to allow an undesired connection attempt to get into any part of your network, so stop it well before it reaches the server.
answered Aug 12, 2009 at 12:17
You could also have a user specifically for this purpose and deny other users this right.
-
It is a shared account, many people have the password. I would like to prevent them from logging in except from the single computer.– PaulJun 17, 2009 at 1:33
One idea would be to configure VPN access using L2TP instead of PPTP. This allows you to require client computer authentication using either a computer certificate or a pre-shared key.
So it would take both a client username/password and a workstation authentication in order to successfully connect to the VPN server. All of this is built-in to Windows RRAS. Need more information drop me a note.
A good article to look at would be TechRepublic (certificate based) and the Microsoft KB articles (Pre-shared keys).
