Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have 10 windows workstations setup that establish a VPN connection each to the same server and then each establish a RDP session. I would like to share a single VPN connection between these workstations, and then allow them to establish their individual RDP connections. Does this make sense?

I apologize if my question has already been answered. I tried looking online for solutions and did not see any. Most of my background is in software development - I am trying to learn more about systems administration.

I appreciate your time in reading this and helping me learn. Thanks.

share|improve this question
What are you trying to achieve? What is the problem with the current setup? – rthomson Nov 5 '11 at 20:02
up vote 3 down vote accepted

You need to initiate the VPN connection at your gateway, which is the device that provides your internet connection.

Entry-level and home devices generally don't permit this, so you'll need a mid-level device, or flash your device with a new firmware if you can (such as tomato or dd-wrt). There are also entire OS's dedicated to firewalling that you could put in-front of your router to use as your default gateway such as PFSense (Unix & Free), or Microsoft TMG (Windows, not free). All server OS's can also do this (Linux - iptables and pptpd, and for Windows Server RRAS).

Depending on the support of your firmware, you will then create the VPN connection to your host. A lot of modern routers have dropped support for PPTP tunnels (too insecure? not sure why), so you need to use L2TP or IPSec. This will depend entirely on your device. If you're using OpenVPN you might be out of luck.

If the destination network is on a different subnet to your local network (you better pray it is), then routing rules will be created automatically on the router to send all VPN traffic over the VPN link. So, then you probably (read: definately) want to lock down the source and destination networks and protocols that can run over the VPN.

So you would want to lock VPN traffic down to:

  • Source: IP Addresses of those 10 machines
  • Destination: IP Address of the RDP server
  • Port: 3389 (RDP)
  • Action: Permit

And then a final rule:

  • Source: All
  • Destination: Entire IP range of the destination VPN
  • Port: All Action: Deny
share|improve this answer
Thanks. I am going to look into setting up a PFSense gateway. – Brian Stinar Nov 7 '11 at 16:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.