short question: I'm usually a linux admin but need to setup a Win2k8 R2 server for a student project. The server is running as VM on a root server and has a public internet IP assigned. Additionally I need a VPN server to access some services running on the server. I managed to set up a working VPN gateway via the Routing and RAS service which assigns clients an IP in the private subnet with the Interface "Internal" listening on Additionally I set up the external interface as NAT interface.

So I can connect to the VPN server, get an IP assigned and the server additionally does NAT and I can access the internet over the VPN connection. The only thing I additionally need, is that I can access the server itself over that internal IP (e.g. client, server as I want to access some services which I don't like to expose to the internet and restrict them to connected VPN clients.

Does anybody have a hint, which configuration I'm missing here to be able to access the server over the VPN connection?

EDIT: VPN clients get assigned the IP from the private subnet with subnetmask, I guess that might be the reason I can't access the server on the private IP address although it's in the same network range. Any ideas how to change this? I defined a static address pool in the Routing and RAS service, but I can't change the netmask there.

EDIT2: I can't access the server from the client, but I can fully access the client from the server (ping, HTTP). I guess it has to do with firewall configuration.

Thanks in advance, Mathias

  • by "access" what service/ports are you referring to on the server? I suspect the Windows Firewall is your first place to look. – Bret Fisher Mar 18 '11 at 15:37
  • I tried access with ping and HTTP. I just added edit #2, I can access the client from the server, so the network seems to work fine and you are right with the firewall. – maff Mar 18 '11 at 15:40
  • Alright, I disabled the firewall on the RAS interface. now all works as expected. Thanks! – maff Mar 18 '11 at 15:55

subnet is normal, because you are using PPP (point-to-point type of VPN connection). Also, you can look, at the vpn client, ipconfig /all , and you will see that your client has some ip, for example:, and there is remote gateway (your vpn server, intranet ip), which is for example:

When you setup IP addressing on RRAS, please make shure that servers VPN ipaddress is not the same as servers local ip address, for example: Server LAN: Server VPN address: Client IP:

Also, if you need to visit server, go to, not, This is normaly solved by using DNS server, and RRAS registers both IPs in DNS.

Also if you need to access LAN side, you need to enable ARP Proxy, so your vpn clients can go to lan subnet and vice versa.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.