Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to set up a VPN between my LAN:

  • Windows 7 Ultimate Desktop workstation
  • OpenSuse 9.3 server

and my co-located web server:

  • Windows 2008 R2 Web Edition server (with just one NIC!)

However, I do not want to expose my LAN resources to threats originating from the web server. I do realize that IP packets must be allowed to travel both ways from through the VPN, but the web server should not be able to access any open ports on my LAN. In other words it should not be able to see my LAN's shared files, my LAN's web server, etc...

How would you create such a setup?



Edit: I do already understand basic concepts about this question, what I am looking for is some kind of tutorial (or several tutorials that work together).

share|improve this question

Drop new/unrelated traffic from the webserver. If you have no other way of dojng this you can do it by routing all the LAN's traffic through the Suse host, i.e. turn the Suse host into a gateway. Then use iptables on the Suse machine to allow related and established traffic but to drop new connections from the webserver.

I.e drop connections intitiated at the webserver, but allow packets from the webserver that are related to connections that have been established from your Suse gateway.

share|improve this answer

It doesn't work quite so well using clients to create a VPN tunnel but may work depending on what software you are using.. the normal way of doing this would be to create a site-site VPN using the routers/firewalls on the two networks to establish the VPN between the two separate networks e.g your LAN and the LAN the server sits on.

You would then firewall inbound requests onto your LAN and optionally outbound requests down the tunnel on the opensuse LAN.

This will allow traffic to come back to your LAN from the server where you have initiated the connection but prevent the server from initiating connections into your LAN.

share|improve this answer
Thanks for your reply, but this doesn't really help because it's still too vague. Please see my edit above. – Adrian Grigore Aug 16 '10 at 8:01

Either put a firewall in all your LAN computers, or put a "firewall router" between the web server and the LAN.

I don't think you need a VPN, just setup your firewall to allow or not each type of connection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.