Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have recently installed 2 IP Video Conferencing kit, which currently we only used internally with laptops connected to a VPN connection. However we have started using it more extensively and require some method of port forwarding. We currently use NAT to allow internal WS to access the Internet. I was thinking of using reverse NAT to do this, any idea's on how I can implement it using JUST Windows Server 2003. This is only an interim solution so I only need the immediate problem solved and not solutions or alternatives. We do plan to use Cisco ASA in the very near future.

share|improve this question
up vote 1 down vote accepted

You can use Windows Server 2003's Routing and Remote Access Service (RRAS) to implement a firewall/NAT solution.

You need a server with two network interfaces, one connected to your LAN and the other one connected to the internet.

On the internal one, give it a static internal IP address, the proper subnet mask and NO gateway.

On the external one, give it your public IP address(es), the proper subnet mask and your default gateway.

Verify your can ping both internal and external addresses from that server.

Go to Start -> Administrative Tools -> Rounting and Remote Access, right-click on the server name and choose "Configure and enable"; configure it for NAT, choose your external interface and accept all default settings.

Have all your intenal machines use the internal address of your server as their default gateway.

Done, you have Windows-2003 based NAT router/firewall.

Now you can configure it to allow incoming connections on specific IP address/port(s) and forward them to internal servers.

It's quite straightforward, actually, and powerful enough for most simple setups; if you want a REAL Microsoft-based firewall solution, anyway, you should go to ISA server.

share|improve this answer
Thats pretty much how we do it currently but a bridging service we spoke said they are unable to use IP address/port for some reason. So I'm looking at an alternative. Any idea's? – stead1984 Aug 18 '09 at 12:12
What do you mean with "a bridging service" and "unable to use IP address/port", exactly? – Massimo Aug 18 '09 at 12:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.