Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company has a server in a colocation center. It runs all of our stuff. I have a couple machines that are throughout the world who need to join that domain.

We are using LogMeIn Hamachi as our VPN. We're a startup, don't have a lot of funding and would like to avoid spending lots of $$$.

Do we have to purchase a VPN appliance, such as a SonicWall or Cisco box?

I thought about a software vpn such as Forefront. But Forefront wanted 4GB of ram--and our main server has 6. Maybe it would be possible to setup an open source software vpn as a virtual machine perhaps (we have and use Hyper-V a lot).


share|improve this question
up vote 2 down vote accepted

If your server is 2008 R2, and your client machines are Windows 7 then I'd be looking at Microsoft SSTP Remote Access / Direct Access.

It's built in and connects over HTTPS, so you should have all the parts ready - I've never seen it in action or configured it though, so I can't recommend a guide.

Otherwise, I think Windows server has always been able to be a PPTP/L2TP VPN endpoint, and Windows deskops come with PPTP/L2TP VPN support as well.

Outside that, for open source solutions you're onto the likes of FreeSWAN and OpenVPN - but don't expect an easy next/next/finish install for those - or OpenSSH with tunnelling (maybe, not sure if that could be made to work).

Or, of course, a third party like Hamachi - a search for "Hamachi Alternative" finds some other suggestions.

share|improve this answer
So VPN is definitely necessary to join a remote network? It seems obvious that it is, but I just want to make sure before I setup SSTP. – rsteckly Oct 15 '10 at 22:50
Well ... it's not definitely necessary, but it's a really bad plan not to use one. The alternative is to open connections from anywhere on the internet, or to use a firewall to restrict access to just your office addresses - but either way all traffic to/from the server would be unencrypted and the server would be more vulnerable to random attacks. Another option which I've just remembered is Windows can support built in IPSEC VPNs as well, which you can get to from the Local Security Policy settings in Control Panel - Administrative Tools. – TessellatingHeckler Oct 15 '10 at 23:22
It is also problematic because it means all items need publkic IP addresses. Otherwise you can - as I do - hide the internal networks with private IPs and just use a VPN. I have a setup like that. Although I dont ahve crap servers with 6gb RAM.... 16 is minimum ;) – TomTom Oct 16 '10 at 10:47

You will generally have more cpu overhead when using software VPN, so the results may be slower.

I have seen hardware VPN devices for as low as $300 - e.g. SONICWALL 01-SSC-5946 SSL-VPN 200 Gateway.

share|improve this answer
For now, I think the CPU overhead is okay. We're not really using the CPU output. Is there anything out there that is open source we could use with Active Directory? – rsteckly Oct 15 '10 at 21:57
I do not know of any - I have only worked with hardware VPN. Good luck. – Jonathan Oct 15 '10 at 22:26

Check to see whether your co-location provider has any VPN options you can use to create a tunnel to the network all your servers are on. Well worth it.

If they don't and if you have any spare Us, consider putting a Cisco ASA 5505 or other cheap firewall at each end to join networks together. Hardware firewall is well worth the money, and if you have more than one server at the colo it will quickly pay for itself in terms of time spent configuring and troubleshooting VPN on every one of the servers.

Since you said the server "runs all your stuff" I think a hardware VPN device is going to serve you better in the long run.

share|improve this answer

Grab a couple of PCs and make yourself some VPN appliances with PfSense.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.