Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Not that I would ever use a Wizard, of course, but lets just say that in theory I was when setting up a VPN server. Purely academic you see...

The wizard wants two network interfaces. You must chose one of them for the one that "Connects to the Internet". This seems clear enough, but:

  • What is the interface that doesn't connect to the Internet used for exactly? Is this what becomes the gateway for the clients?
  • Is the one that connects to the Internet the one you would NAT to if the interfaces that connects to the Internet is a private IP? Basically, is this the one that holds the address that clients would use to connect to? (Seems obvious, but never hurts to be clear on these things).
share|improve this question
up vote 2 down vote accepted

NAT is orthagonal functionality to the VPN server functionality.

The expected network topology of the "Remote access (dial-up or VPN)" configuration choice in the Wizard is a server with a NIC connected to the public Internet and a NIC connected to the LAN. The Internet NIC will listen for incoming connections and, once a client has connected and been assigned an IP address (either by DHCP relayed from the LAN or via a static IP address pool on the RRAS server) packets from the PC will be decapsulated and dropped on to the LAN interface (which will also perform proxy ARP for VPN clients automatically). In this configuration, no NAT is configured. The VPN clients don't need NAT anyway, since they're being assigned LAN IP addresses when they connect. (You can see any example of the expected topology in the help topic "Common Remote Access Configurations" under "Overview of Routing and Remote Access" in the product's help.)

If you want NAT, too, you'd choose "Virtual private network (VPN) access and NAT". This is a common configuration where a single server is being used as both a NAT router for the LAN and a VPN server. It's a very similiar configuration to the "Remote access" configuration, but you'll also be configuring the Internet NIC to be, effectively, the "outside" interface for the NAT functionality.

As a point of note: You can configure a RRAS VPN server with a single NIC. You have to use the "Custom" configuration choice in the wizard to do so, but it'll work fine. You'll need to forward the appropriate protocols through the edge firewall to the VPN server. It will receive incoming client connections on the same NIC that it decapsulates packets onto and performs proxy ARP with.

share|improve this answer
I'll see how the custom goes. – Kyle Brandt Aug 5 '10 at 16:08

Ideally, you would have an internal network (say, and an external network (say The external network would operate like a DMZ and is considered to be "on the internet". The internal network would have no direct access to the external network except through a firewall.

The VPN server itself needs to sit between both networks in order to forward traffic back / forth, so VPN users on the outside can access the internal network.

share|improve this answer

Technically it's not necessary to have two interfaces. But most people using MS's RRAS have small/simple networks. It's most common in these situation to have one server that acts as the Internet router (NAT) and also does VPN access. Then it needs one interface for the local network and one for the Internet/Perimeter network.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.