Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are in the process of migrating a datacenter hosted web application to a cloud provider, and we need to set up a VPN tunnel between one of the cloud servers and our internal office network so that we can move/access data securely from an internal database server.

In our current setup we have a hardware VPN tunnel which is setup on the firewalls of the two different networks (office and datacenter). However, if we set up a hardware VPN tunnel to the new cloud hosting provider, we'll incur a hefty monthly charge which I'd like to avoid.

Is there a way to set up a software VPN tunnel between one server running Windows Server 2008 R2 on one network and a hardware firewall on a different network?

share|improve this question
If you're going to down-vote, have the courtesy of leaving a comment so the question can be improved. I'm looking for help here. – ctorx Oct 2 '12 at 21:48
Miles, I'd actually prefer to setup the VPN tunnel from the Windows Server to my internal firewall so I have access to more than just a single additional Windows Server. You modified the question to specify server to server which is not what I'm after. – ctorx Oct 2 '12 at 21:58
up vote 1 down vote accepted

I would simply use the Windows Routing and Remote Access VPN built into windows. You'll need to configure the server (maybe with some certificate setup too), then configure the cloud server to demand-dial into your network or start a VPN connection on boot via script. COnfigure the VPN to redial automatically if it drops.

Winodws 7/2008r2 support four types of VPN: PPTP L2TP SSTP IKEv2

PPTP is insecure, so don't use it.

L2TP requries both client and server certificates issued by the same certification authority (which can be a Windows cert server, external like say Digicert, or even your own OpenSSL install).

SSTP and IKEv2 only require a trusted certificate on the server side (your home office) for remote users doing VPN, but since you will likely want to use computer certificate authentication "EAP-TLS" instead of a username and password so your cloud server can automatically connect, you might need the client certificate anyway.

SSTP is baed on TCP, which is terrible for performance (TCP-in-TCP does not perform well), so don't use it unless you have no other choice.

I would suggest using an L2TP or IKEv2 with EAP-TLS authentication. Set it up as a persistent demand-dial connection in Windows RRAS so it connects automatically whenever it has connectivity home.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.