Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a remote retail store which used to be on a hardware VPN (the hardware recently failed and we are looking at upgrading so we don't want to replace it right away). They only need occasional access to the shared drives so I was going to set them up with the ability to log in remotely through the vpn connection allowed by windows. However, the store user is a shared logon and many people have this password. I don't want them to be able to log in to the vpn except from the store, which has a static IP. Is there some way to limit the connection for a specific user to a specific IP address?

share|improve this question
up vote 1 down vote accepted

I would try to do this on the firewall. But with PPTP 'Routing and Remote Access'. You can set this under the IP tab of 'Remote Access Policies' with the 'Input Filters'

share|improve this answer

Set it up on the firewall. Not the Windows firewall but the primary Internet facing one. There is no reason to allow an undesired connection attempt to get into any part of your network, so stop it well before it reaches the server.

share|improve this answer

You could also have a user specifically for this purpose and deny other users this right.

share|improve this answer
It is a shared account, many people have the password. I would like to prevent them from logging in except from the single computer. – Paul Jun 17 '09 at 1:33

One idea would be to configure VPN access using L2TP instead of PPTP. This allows you to require client computer authentication using either a computer certificate or a pre-shared key.

So it would take both a client username/password and a workstation authentication in order to successfully connect to the VPN server. All of this is built-in to Windows RRAS. Need more information drop me a note.

A good article to look at would be TechRepublic (certificate based) and the Microsoft KB articles (Pre-shared keys).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.