0

I work at a startup that is doing some aerospace engineering work, and the engineers have two related but distinct asks for our network that I am not sure how to provide.

  1. Remote access to workstation. Some engineers use desktop computers to do their work, and they would like a way to access them remotely to do design work and simulations from home while having all the actual computing happening at work. How do I implement this for them? Is there an application or service that is "plug and play" for this type of thing?

  2. VPN system. Other engineers use mobile workstations that they take all over with them. We have a license server for our CAD and simulation software licenses set up on our LAN, but if the engineers with mobile workstations are out of the office, they cannot currently access the license server and so cannot use our software suites. I assume a VPN is the way to go to solve this, as they would be able to get into our LAN and ping the license server to use our software from anywhere with an internet connection. How do I set up a VPN to do this? Do I need special hardware, or can it be done with software?

For additional background, I am not a network engineer. I have become my startup's IT guy by default because I can figure things out, but I have no formal background or training in IT or networking. I did set up my company's network thus far, which includes Four DSL WAN connections (don't ask...), a load balancing router to chain them together, a 24-port Managed PoE switch, 3 VOIP phones, and about a dozen workstations.

Hardware:

4 - CenturyLink Zyxel C1100Z DSL modems

1 - TP-Link TL-R470T+ load balancing router that also handles our DHCP for our LAN

1 - Netgear JGS524PE-100NAS 24-port switch.

The switch is connected to everything else, which includes our endpoints, a Linksys WRT3200 wireless router configured as a WAP, and a MiniX Neo running Windows 10 Pro serving as our license server.

3 Answers 3

3

You need a VPN also for item 1, since for remote access (RDP/VNC) you need to access the internal network anyway.

You need to look into your router's documentation and see if it supports any VPN server features. If it does, then you configure the VPN there and install corresponding software to the workstations that need it.

If it does not have VPN support, then you need to have a computer which runs for example OpenVPN server, and you port forward connections from the router to the OpenVPN server.

Then you need also to make sure that you either have a static IP address or dynamic DNS solution installed, so that you have a static endpoint where your VPN clients are connecting to.

Remote desktop features are built-in in MacOS and Windows, you just need to search how to enable them. The harder part is the VPN.

Another note in general. You or the company needs the be aware of the point when the systems need to be set up by best operating practices instead of "figuring out how to do things". At some point, this method is simply not enough and could pose a significant risks to operation.

1
  • 1
    Thanks, Tero. This makes sense to me in principle, but more importantly I think this will be what I need to finally make a good case to my boss why we need to actually spend money on a real IT solutions service rather than just have me hack around. :)
    – WHA
    Jun 29, 2018 at 16:04
1

The TP-Link Loadblancer is cheap and doing a good job, but I wouldn't recommend it as a good solution for both your requirements.

First, you have to consider that each WAN-Port (where the DSL-Modems are connected) has his own public IP-Address. So you have to choose one of them to become your VPN-servers public IP.

In best case this is a static IP. If it's a dynamic one, you should ask for a static one. If that is not possible you could workaround it with a dynIP-Service (I wouldn't recommend it because it makes the whole solution unnecessary complex and weak).

In fact, your two requirements are basically the same: an external device needs to "dial-in" to your VPN-server who's reachable at the public (static) IP of one of your DSL-Lines. The TP-Link TL-R470T+ has an appropriate Advanced>NAT-section where you have to configure and so allow the incoming VPN-connections being forwarded to the internal VPN-Server.

This VPN-server is a device you need inside your LAN. There are commercial solutions like the TPLink Savestream https://www.tp-link.com/us/products/details/cat-4909_TL-R600VPN.html Such a solution usually is cheap and include both a documentation and Software for your client computers.

Or alternatively, you can look for an OpenVPN-based solution (device) and learn more about VPN-setups at https://docs.openvpn.net/connecting/

As soon as you know what type of VPN you're going to use, this has some specific port numbers, that must be forwarded in your Loadbalancers NAT-configuration to that internal LAN-IP you assigned to the VPN-Server device.

At the end when your client devices have "dialed in" to your VPN-server they will be able to see all other devices in your LAN.

To work on the work computers desktop you have to use either built in solutions like RDP or additional software like VNC (free) or Teamviewer or AnyDesk (commercial)

Please consider also spending 10% of the time you will go to use to set it up for your own, and lookup for an experienced and honest IT-Service who provide you a solid and instantly working solution.

0

If you have a Windows Server in addition to the network equipment, then you can use that server as the remote access VPN server. Once they have connected through the VPN, they can easily use the built-in Windows remote desktop or Apple's dito in order to connect to the end-clients' desktops.

Here is a guide how to set up your Windows server as a VPN gateway: https://www.thomasmaurer.ch/2016/10/how-to-install-vpn-on-windows-server-2016/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .