How to securely enable file sharing over PPTP on Windows 2008 Server

Question

I have set up a Windows SBS 2003 domain (LAN) and a stand-alone Windows 2008 Server (web server) at another location (workgroup). I established PPTP VPN connection (SBS dials web server) over which users from LAN should be able to access web server. On web server I enabled TCP/IPv4 and File and Printer sharing protocol. It has a few external addresses (one of them is default) AND one local address (192.x.x.x) assigned to network adapter. Firewall allows port 445 for file sharing.

There's the problem - I can not enable web server file shares to be visible to LAN users and ONLY to LAN users:

1. From SBS I can access webserver but I cannot access webserver from LAN workstations (XP, Vista). I have had same configuration - I have just replaced old (web server) Windows 2003 server with 2008 so SBS settings are the same (static route, DNS etc.). How can I enable file sharing on web server for LAN workstations?
2. Now I have opened File and printer sharing to the internet which is of course totaly unsecure. I tried to secure the tunnel so I moved RAS (VPN) connection (Network Center) on web server to "Private" profile and moved firewall port 445 to "Private" profile but suddenly file sharing does not work and I cannot telnet webserver on port 445. How can I secure file sharing so I do not have to open it to the internet?

Answer 1

While it's possible to do what you're trying to do strictly with RRAS and the Windows Firewall, it's going to be a fairly complex configuration, and will not be secure if not properly configured. You may find that operating system patches impact the functionality, as well. I don't know that I'd be very trusting that this, once setup, would continue to work properly in the face of patches.

To my mind, you would spend a lot less time on this if you invested in a hardware firewall / VPN appliance to sit in front of the remote web server computer to terminate a VPN there. If you're able to do that, you'll end up with a solution that I would expect to be a lot more robust.

Answer 2

I'm with Evan on this one. Use routers that can act as VPN endpoints. I like Drayteks, though these days all but entry level routers will do VPNs. Using a hardware VPN makes the routing very straightforward.

JR