I have a Cisco 877 router which connects my network to the Internet using an ADSL line, a single public IP address and NAT; the IOS version is 15.
Everything is working ok, but I'd like to configure this router to be a VPN server, to be able to connect to the network from the outside.
I've tried looking for documentation, but everything I can find is related to having the 877 act as a VPN client, or to site-to-site VPNs; I can't find anything about letting single remote computers access the internal network, which is something I can do quite easily using Windows' RRAS or ISA Server.
- Can the Cisco 877 act as a VPN server for remote client computers? (Looks like it should, but just to be sure...)
- Which type of VPNs does it support? Do they require some special software on the client machines, or can they be used by standard out-of-the-box Windows computers?
- And, finally: how to set up this?
I know the 877 is a SOHO router, and it's not the best choice as a VPN server; but this is my home network, I only have one computer (for now) and I'm the only user. I'm definitely not going to buy an enterprise-grade router just to be able to reach my PC when I'm at work :-p
I'm really stuck with this, after many tests I was never able to get it to work. I'm adding a bounty to the question, which will be awarded to a fully working solution (not to some pointer to cryptic Cisco documentation or unrelated scenarios).
In order to allow people to help, here's my current router configuration (stripped of non-relevant and private details). Let's hope someone finally can help me get this working.
- The four Ethernet interfaces are all assigned to VLAN 1.
- Internal network is 192.168.42.0/24, router's IP address is 192.168.42.1.
- External IP address is supplied by ISP; it's a public and static one, fully routable.
- NAT is (of course) enabled.
- ADSL connection works OK.
- The router is the DNS server for the internal network, forward queries to the ISP's DNS.
- There is no DHCP server in the network.
- There is a single user account with privilege level 15.
What I want:
- The router acting as a VPN server, enabling external clients to access the internal network.
- L2TP would be preferred, but even PPTP would be ok.
- If possible, I want this to work with Windows' built-in VPN client (which supports PPTP and L2TP); I don't want to install Cisco VPN client or anything like that on external computers in order for them to be able to connect.
Here's the config:
version 15.0 service password-encryption hostname Cisco877 aaa new-model aaa authentication login default local aaa authorization console aaa authorization exec default local aaa session-id common ip source-route ip cef ip domain name <my ISP's DNS name> ip name-server <my ISP's DNS server> no ipv6 cef password encryption aes username <Router's username> privilege 15 secret 5 <The encrypted password for my user account> ip ssh version 2 interface ATM0 no ip address no atm ilmi-keepalive interface ATM0.1 point-to-point pvc 8/75 encapsulation aal5mux ppp dialer dialer pool-member 1 interface FastEthernet0 spanning-tree portfast interface FastEthernet1 spanning-tree portfast interface FastEthernet2 spanning-tree portfast interface FastEthernet3 spanning-tree portfast interface Vlan1 ip address 192.168.42.1 255.255.255.0 ip nat inside ip virtual-reassembly interface Dialer0 ip address negotiated ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication pap callin ppp pap sent-username <My ISP's username> password 7 <The encrypted ISP password> ip forward-protocol nd ip dns server ip nat inside source list 1 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 access-list 1 permit 192.168.42.0 0.0.0.255 dialer-list 1 protocol ip permit