SBS 2003 - Resolving Address names

Question

I have an SBS 2003 R2 box that sits behind a a firewall/router. The server and firewall/router have been setup to accept incoming VPN connections, and this works fine: Users can connect to the server via a VPN tunnel and are assigned a server generated IP address.

The server itself is a simple file server which allows Remote Desktop connections; each client has a username and password setup on the server to RD into, but we make no use of the fancier aspects such as active directory logins and so on.

However, users are complaining that they have to enter an IP address (the servers local address behind the firewall) in order to Remote Desktop into the server, rather than use the server's name. Can I configure this on the server to resolve the name "\myserver" to its IP address?

Cheers,

Lenny.

Answer 1

I thinm you're saying that the VPN clients have to put in the server computer's IP address into their Remote Desktop client in order to access the server computer via RDP. Assuming you are, there are a few different ways to handle what you're trying to do.

• If you're serving VPN clients with Microsoft Routing and Remote Access Service it will pass the DNS and WINS server addresses configured on the server computer's NIC to VPN clients. You could configure that server computer to be a WINS or DNS server itself, "point" its own NIC's DNS and WINS settings to itself, and then create either a DNS zone and host record for the server, or make an entry in the WINS server.

• Another possibility: Presumably your company has some kind of Internet presence with an Internet domain name-- say "company.com". You could create an "A" record in the Internet-faceing DNS for this server computer, like, "rdp.company.com", and "point" the IP address on that "A" record to the private (192.168.x.x, etc) IP address of the RDP server. Hopefully you've already got VPN clients using a name to connect to the VPN service on the server computer's public IP address (say, like, vpn.company.com "pointing" to the public IP address being forwarded to that server computer). Creating a second "rdp.company.com" "A" record wouldn't be a big deal.

Odds are that a top-down evaluation of how you're doing name resolution and authentication in your network is probably the best thing to do, but hopefully one of the solutions above will get you by in the short term.

Answer 2

By default when they setup a Windows VPN connection the "use default gateway on remote host" is checked, so they should be able to resolve sbserver.yourdomain.local without you doing anything.

However, I'm baffled why you're letting your users RDP into your server (which by default, they shouldn't be permitted to logon through Terminal Service or Interactively, unless they're all domain administrators or you modified the security policy) and why you're not using Remote Web Workplace, which is the killer app for SBS Server.

With RWW, your users can go to http://your.router.tld/remote in Internet Explorer and seamlessly login and connect up to their own machines, not the server -- this way you're also not opening up your server to their (potentially) infected machines via VPN. Not only that, but there's also Outlook Web Access if you're using Exchange, which is another big win for SBS (it's actually pretty ridiculous how much you get for one SBS Server license).

It's probably already configured too -- from the server, open IE and go to http(s)/localhost/remote and after you click ok to the certificate warning, you should get a login. Try to authenticate and connect up to someone else's machine.