0

We are a small company with a TMG firewall in a rather remote location where the DSL line we have cannot be upgraded to higher bandwidth. With that asymmetrical DSL line we generally have a correct browsing experience except when an upload is taking up the bandwidth.

During the upload VPN clients become very slow and not responsive. We have a second DSL line and I would like to pass all VPN traffic on that second DSL line and keep the first for all normal internet traffic.

Is this a supported configuration of TMG?

I would expect the steps to be:

  • add an additional nic in the server, configure with fixed IP, no gateway (TMG can only have one gateway)
  • connect that new nic to the second DSL line, forward VPN port on the DSL router
  • in TMG create a new Network (named for example External-VPN) and select the new nic
  • in TMG > Remote Access Policy > Select Access Networks and select that new 'External-VPN' Network.
  • check/update firewall rules

I have searched online and don't find much about a second external nic dedicated to VPN. Is this something TMG can do? Anybody have experience with this type of config?

Improve this question

1 Answer 1

Reset to default
0

add an additional nic in the server, configure with fixed IP, no gateway (TMG can only have one gateway)

Correct, but I assume you mean default gateway. It's not TMG that can only have one gateway, that's just how networking works. Any device, no matter how many interfaces it has, can only have one default gateway.

connect that new nic to the second DSL line, forward VPN port on the DSL router

If you only have the TMG box on this second router, then I would not use the router as a router, I would just use it as a modem. Put it into bridge mode, and configure a PPPoE connection on the TMG host itself. Then you have your public IP address connected directly to your server, and you eliminate a massive headache in VPNs (NAT), and you make your routing easier.

  • in TMG create a new Network (named for example External-VPN) and select the new nic
  • in TMG > Remote Access Policy > Select Access Networks and select that new 'External-VPN' Network.
  • check/update firewall rules

From here my TMG memory is pretty fuzzy, but basically, yes. The biggest issues you're going to face are:

  • Traffic flows in through one interface (the 2nd ADSL connection), but out through a different interface (the original modem). This is not illegal from the TCP/IP standpoint, but most firewalls will immediately drop that outbound packet because it does not recognise the connection. Additionally, you need the outbound packet to go over the originating interface so that you're not using your precious ADSL bandwidth. I'm 90% sure that Windows will manage this OK, but that 10% could be a nightmare to debug.

  • TMG is horrifically bad at giving you useful feedback in the firewall logs. You end up with all sorts of ambiguous failures and error messages that just don't make sense.

However, I know that this can be done, as I have seen it done in the past. I just don't recall the specifics.

Improve this answer
2
  • Thanks for your reply and useful comment @Mark, specially about routing devices having always only one default gateway. I have been searching more about this and found this post that seems to indicate that getting VPN to work on a tri-homed ISA (and I suppose TMG) server's DMZ interface will not work. isaserver.org/articles-tutorials/configuration-general/…
    – NicoMT
    Mar 5, 2016 at 18:19
  • The followup forum disscusion of this post (forums.isaserver.org/m_90046000/tm.htm) seems to show that it is possible in a site-to-site scenario where both the source and destination networks are known, but not for simple clients on the public internet. @MarkHenderson So even though you say you have seen it done and except if somebody has a working similar setup and can indicate how it's set-up, I will consider it can not be done this way.
    – NicoMT
    Mar 5, 2016 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .