Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are attempting to set up a guest WLAN network that is isolated from the rest of our network. This is proving difficult due to a couple of technical reasons. My first choice was to use a separate VLAN, on which our Firewall's handy WLAN port would handle DHCP, DNS and the network isolation we need. Unfortunately, due to the fact that our main office and our Internet connection itself are in different locations connected by way of a Metro Ethernet connection, I'm at the mercy of our ISP for VLAN transit.

They won't pass a second VLAN between our two sites. And my hardware doesn't support 802.1ad "Q-in-Q", which would also solve this problem. So I can't use the VLAN method for isolation. At least not without spending money.

As our Firewall can handle IPSec site-to-site VPN connections, I hope it is possible to connect a Server 2008R2 (standard) server I have in the office location to the WLAN and provide gateway services to the firewall. Thusly:

Network diagram

Unfortunately, I don't know if it is possible to connect the two this way. The firewall has a pretty flexible IPSec/L2TP implementation (I've used it to connect iPads in the wild), but is neither Kerberized or supports NTLM. The Connection Security Rules view on the Windows server seems to get close to what I think needs to be done, but I'm failing on figuring out how to get it to do what I need it to do.

Is this even possible, or do I need to pursue alternate solution?

share|improve this question
  1. Well, I would give guests only access to one computer (their default gw) which is configured for proxying/NATting to the internet.
  2. One way to tunnel a vlan through another if you have a linux box somewhere: Ubuntu Community - VPN over SSH
share|improve this answer
That's just the thing, in this location I don't have a Linux box available. That solution is possible under 'pursue alternate solutions.' – sysadmin1138 Jun 19 '12 at 15:39
up vote 0 down vote accepted

It turns out that Server 2008 R2 Standard does NOT have an ability to support a Site-to-Site VPN. Microsoft is shipping that functionality with their and Forefront products.

That qualifies as "other solutions" for this question, equivalent to Linux-based IPSec solutions.

Unfortunately, it looks like Standard does NOT do what I need it to do.

share|improve this answer
I'm sorry? RRAS has been supporting site-to-site VPNs since (at least) Windows Server 2003. – Massimo Jun 21 '12 at 21:43
@Massimo Then they're hiding it rather well, since I couldn't find that functionality. RRAS was my first thought, but they seemed (to me anyway) to have changed the name with 2008 and done something weird with it. – sysadmin1138 Jun 21 '12 at 21:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.