Today I have the following setup:
- All my servers are located in the internet, they are protected by Windows Firewall and Advanced Secutiry using IPSec with certificate. It includes the Domain Controllers.
- All the clients computers have a GPO and the corresponding certificate to use the servers.
All in all, it's almost perfect, there's still one thing that doesn't work, some Internet Service Providers block some communication ports (135 for instance), which creates troubles when the client connect through them.
I don't want to rely on a VPN setup, because all my servers have Internet IP, so why should I?
Looks like the IPSec Tunnel may be the way to go. From my understanding (I have hard times to find documentation about this, event on the MSDN) I can setup a tunnel with the client acting as a Gateway and setup a remote gateway in a dedicated server.
The real question is: will the tunnel communication be encapsulated into one given UDP/TCP port rather than each requested being straightly forwarded?
For instance if the client tries to contact the port 135 of one of my domain controller, will it be transmitted through the port 135 in the internet wire or tunneled into a one unique/predefined port (say 443 for instance) that have better chances to be opened. Same goes for any other port the client tries to contact, all encapsulated into the 443.
I hope it's more clear that way, I honestly though it already was the first time! :)