1

I have a Windows Server 2008 R2 which is a member of a domain, but is placed in a remote location. The server is directly connected to Internet. Clients need to access a particular insecure TCP service in this server (ports 9730 and 9731). Since clients have dynamic IP addresses I cannot know in advance, I thought it would be nice to have them connected through a VPN in order to access the insecure service, but ONLY to access that service, like this:

Client ------> VPN TUNNEL ------> (Insecure service at Server)
|
\----> (Normal internet access)

I'd enable the insecure ports in the firewall only from VPN accesses.

For this I configured RRAS in the server and gave it a static IP address range (172.19.1.2 through 172.19.1.254) to serve the clients.

First I thought I could use DHCP to assign the addresses, but I cannot use DHCP in my LAN connection (not allowed by the hosting service). I tried configuring DHCP binding it to a Microsoft Loopback Adapter, but that's not supported as a DHCP source by RRAS.

What I want to accomplish is to send specific DHCP options to the client (network mask, routing table, etc.). In particular:

  • Prevent the client from having the server as default router (without changing the client's "use default gateway in remote network"). Have it as a route for the server's internal RRAS address only (172.19.1.1).
  • Prevent the client from using a 255.255.0.0 mask for the 172.19.x.x network (a 255.255.255.0 mask would be better).

Can I do that with RRAS only? How?

Currently, the only solution I can think of is to use DHCP in the LAN adapter, but filter DHCP packets so they don't reach the provider's network. However, I'm not sure if that will work.

1
  • Filtered DHCP didn't work, as the DHCP packets where blocked for both the outside LAN and the inside. Nov 17, 2011 at 22:19

0

You must log in to answer this question.

Browse other questions tagged .