Ok, so I have kind of a funky setup, let me see if I can describe it.

I have a single VMware host with a public IP address 74.xx.xx.x Inside that host, I have 3 VM's

  1. Web Server - 1 NIC -
  2. SQL Server - 1 NIC -
  3. RRAS/VPN Server - 2 NICs &

Due to Limitations of my ISP, all of the VM's are connected to the host VIA NAT. I have NAT setup for the webserver so all incoming requests on 74.xx.xx.x via port 80 route to This works fine.

Now I want to set up a Windows 2008 VPN server inside this NAT network and forward the correct traffic to it. My questions are as follows?

  1. What are the TCP/UDP ports that i have to forward?
  2. What special configuration is needed on the server and clients since this is behind a NAT
  3. Any other advice would be wonderful.

1 Answer 1


Your setup is no different than how many physical RRAS servers are set up including my own at a small office. If you're talking an RRAS VPN you're more than likely talking about a PPTP VPN... unless you have an internal CA and want to futz around with IPSec. (Hint: If you want to futz around with IPSec VPNs, don't. Get an SSL VPN appliance if security is on your mind.)

Simply forward TCP port 1723 and IP Protocol 47 (GRE) to your RRAS server and you're good to go. Also note that you need to edit / add a Remote Access Policy to allow incoming connections. If I recall correctly, by default no incoming connections are allowed. For instance, I created a group called "VPN Users" and then created a policy called "Corp VPN Policy" that has policy conditions set to allow connections if any incoming request is from a user account that is in that group (as well as making sure that only MS-CHAPv2 PWD is being used, but I digress...). You must elevate that policy higher than the default policy which will deny everything. All of this is done in the "Routing and Remote Access" portion of "Network Policy and Access Services" within Server Manager.

There is no special configuration needed on the clients. Windows's built in VPN client will work like a charm. I've even used Linux machines and pptpclient to connect to it with smashing success.

Now, after typing all of this I realized that this was all true for my Server 2003 RRAS box and you said you had a Server 2008 machine. Your mileage may vary. =)

  • The NAT on VMWare can only forward UDP and TCP ports. Any idea how to forward IP protocol 47? Nov 21, 2009 at 5:44
  • Are you using VMWare Server or a hypervisor?
    – Wesley
    Nov 21, 2009 at 18:36
  • Server...I don't necessarily have to use the VMWare NAT. I could do a Host Only network, and Configure the route manually...i just don't know how... Nov 21, 2009 at 18:38
  • From preliminary searches, it seems that GRE is not capable of being forwarded when using a VMWare NAT. Only a bridged connection will allow GRE to go through. =( I hadn't considered that VMWare NAT would have that limitation.
    – Wesley
    Nov 21, 2009 at 18:40
  • Can i configure it to route somehow VIA a host-only connection? Somehow modify the route table? Nov 21, 2009 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .