This should be a relatively straightforward RRAS VPN setup, but I'm not getting the behavior I want.
I have two subnets, a Prod Server subnet and a Client subnet. Both are publicly routable. I have created a VPN server (Win 2008R2) with a NIC in both subnets. DHCP is running on a single server in the Server subnet, and clients get their requests forwarded to the server via an IP-Helper configured on the router.
What I would like is for VPN clients to connect to the VPN server using the interface in the Server subnet (where I can more easily manage the firewall rules), but then get IP addresses in the client subnet via DHCP. Is this even possible? I can't seem to figure out how to tell RRAS which interface to use to get its block of 10 DHCP IP addresses.
I can put the public VPN IP in the client subnet if that's required, and have in fact tried that. I've tried both with and without DHCP Relay Agents configured in RRAS.
I always get one of three results:
- No connection to the VPN -- "Error in assigning inner IP address to initiator in tunnel mode."
- Client connects and gets APIPA address (169.254.x.x)
- Client connects and successfully gets IP address from DHCP -- from the SERVER subnet.
Is there any way to do this with actual DHCP? Or must I use the "static address pool" option instead?