I've been given the cumbersome task to totally redo the IT-infrastructure for a customer's office. They are currently running Windows XP all over, with one computer acting as a file server with no control over which users have access to which files, and so on. To top it off, this file server also functions as a workstation, which means it gets rebooted every time the user notices some sluggish behavior or experiences problems with flash games. To say the least, this isn't working for them.

Now - I've got a very slim budget, but I need to set up a new server, and I wish to run Windows Server 2008 on it. I also need the ability to access the network remotely via VPN. Would it be a good idea to install VMware ESXi 4.1 onto the new server, and then run Windows Server 2008 as well as a separate Debian install for openvpn on it? I don't like the Domain Controller for the future AD to also run a VPN-server, because of stability issues when something goes to hell with either of them. There will be no redundancy though. However, I'm not sure if there is something to gain by installing a VPN solution on the Windows Server itself, when it comes to accessing file shares on the network via VPN.

I don't know how to enable users logging in via the VPN to access the remote files, since they will be accessing the network from their own home computers (which is indeed a really bad idea, but this is what I've got to work with). They won't be logged in to the windows Domain, but rather their home workgroups. I need to be able to grant access to files in certain directories based on the logged in AD-user, but every computer won't necessarily be configured to log into the domain. I'm not sure how to explain this in a good way, but I'd be happy to clarify if somethings not clear.

Any help would be great, because I've got a feeling that I can't do this without introducing a bunch of costly new rules when it comes to their IT-solution. I'd rather leave that untouched and go on my merry way to the next assignment.


I'm having some difficulty finding questions to answer in your post. I'll make some general statements and hope for the best.

  • Having a server computer with centralized file storage and single sign-on (to facilitate access control) is a Good ThingTM. Make sure you plan for hardware fault tolerance and for data backup, otherwise you may end up decreasing their tolerance for risk (all their "eggs" being in one "basket").

  • The built-in VPN server in Windows works fine. Being a domain controller, though, hosting a VPN there ends up creating a multi-homed DC, which Microsoft discourages. It can certainly be done, though. Personally, though, I'd eschew running a VPN for individual user remote access and opt for running a Terminal Services Gateway instead. This keeps the potentially malware-ridden user home PCs at "arm's length" from the LAN, simplifies the authentication concerns you describe for remote file access greatly, frees you from having to worry about applications performing poorly over a VPN connection, and will very likely give the users everything they want.

  • Whether you user a hypervisor or run the OS on the bare metal is your choice. You'll spend more money getting a RAID solution that works under VMware ESXi versus using a plain vanilla SATA chipset and software RAID-1 in Windows Server 2008 (which works fine).

You can get a lot of mileage from Group Policy, WSUS, and other OS features moving into a server-based environment from peer-to-peer. There's been a lot of discussion about such advantages in other questions on Server Fault so I won't re-hash them here.

  • To add to most of Evan's points and some of your own, I think you should have at least two physical servers. – SpacemanSpiff Jan 4 '11 at 21:01
  • Some good comments here. I'd like to add that sometimes a proper VPN is required. If you do need that then a number of routers support OpenVPN. e.g. any router that can run DDWRT. There is an OpenVPN build of it. Or perhaps buy a Mikrotik router (they are very inexpensive and very powerful). – Matt Jan 4 '11 at 21:01

I believe your thinking is sound, given what you have to work with. You make no mention of a firewall and I suspect that site has none. To satisfy your need for a VPN without involving the DC why not make that Linux machine (I prefer to repurpose an old PC, rather than use a VM) as a firewall that will also handle the VPN?

Once connected via the VPN users should be using their normal logon credentials and be authenticated by the DC. Of course that means actually enabling some share/file/folder level access restrictions. Good luck with the politics of that.

  • Mixing trusted and untrusted environments on the same physical machine gives me the willies, personally. – Evan Anderson Jan 5 '11 at 2:30
  • @Evan, I'm not arguing that point but we both know small businesses don't, or can't, do everything the way we'd like to see it done. I have to allow users to work from home just like the OP. I simply have to deal with the situation as best I can, because I can't change it. – John Gardeniers Jan 5 '11 at 3:24
  • I probably read over your statement "I prefer to repurpose an old PC" in my haste. If I were the OP I'd look at a Linksys WRT54GL or something similar (embedded, no moving parts, simple working config out of the box) and then customize as necessary. I'd still be hesitant to put untrusted PCs onto a VPN if the users can accomplish what they need with Terminal Services. – Evan Anderson Jan 5 '11 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.